Merge master and keep both the webhook proxy and crawler file locations.

Co-authored-by: Cursor <cursoragent@cursor.com>

roles/web-static/templates/nginx.conf.j2

@@ -30,6 +30,34 @@ server {
     root {{ (app_catalog[a.name].webroot_pattern | default(web_static_root ~ '/{env}_' ~ a.name)) | replace('{env}', a.env) }};
     index index.html;
 
+{%- set api_backend_name = app_catalog[a.name].api_backend | default('') %}
+{%- if api_backend_name %}
+{%- set api_proxy_prefix = app_catalog[a.name].api_proxy_prefix | default('/api/') %}
+{%- set api_match = namespace(port=0, ok=false) %}
+{%- for item in host_apps | default([]) %}
+{%- if item.name == api_backend_name and item.env == a.env and (item.enabled | default(true)) %}
+{%- set api_match.port = item.port %}
+{%- set api_match.ok = true %}
+{%- endif %}
+{%- endfor %}
+{%- if api_match.ok %}
+{%- set api_host = (app_catalog[api_backend_name].public_hosts | default({}))[a.env] | default('') %}
+
+    # Finance webhooks (Stripe) arrive on the public product host. The SPA
+    # try_files fallback is a static file and returns 405 for POST.
+    location {{ api_proxy_prefix }} {
+        proxy_pass http://host.docker.internal:{{ api_match.port }};
+        proxy_http_version 1.1;
+        proxy_set_header Host {{ api_host if api_host else '$host' }};
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+        client_max_body_size 2m;
+    }
+{%- endif %}
+{%- endif %}
+
 {% if app_catalog[a.name].exact_root_files | default(false) %}
     # Crawlers must get these files, never the SPA index.html fallback.
     location = /robots.txt {