feat(infra): add Cloudflare fallback plan + self-hosted landing pages

Two infrastructure improvements for tech independence:

1. Cloudflare Fallback Documentation (docs/CLOUDFLARE_FALLBACK.md):
   - Plan B: WireGuard + Caddy on Hetzner VPS (€3.79/mo)
   - Complete Caddyfile with all 30+ subdomains
   - Step-by-step failover checklist (~15 min to switch)
   - Plan C: Direct IP with ISP

2. Self-Hosted Landing Pages (eliminates Cloudflare Pages dependency):
   - Nginx container (mana-infra-landings) on port 4400
   - Multi-site config: each subdomain → separate dist/ folder
   - Build script: scripts/mac-mini/build-landings.sh
   - Cloudflare Tunnel ingress rules for 10 landing page domains
   - Storage: /Volumes/ManaData/landings/ on external SSD
   - Domains: it, chats, pics, zitares, presis, clocks,
     manadeck, nutriphi, citycorners, docs

Migration path: Build landings locally, set Cloudflare DNS to
tunnel instead of Pages, then decommission CF Pages projects.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/nginx/landings.conf

@@ -0,0 +1,108 @@
+# Nginx Configuration for Self-Hosted Landing Pages
+# Each server block serves a different landing page from its dist/ directory
+# All traffic comes through Cloudflare Tunnel → localhost:4400
+
+# Shared settings
+gzip on;
+gzip_vary on;
+gzip_min_length 1024;
+gzip_types text/plain text/css text/xml text/javascript application/javascript application/json image/svg+xml;
+
+# Default server (catch-all → it.mana.how as homepage)
+server {
+    listen 80 default_server;
+    server_name _;
+    root /srv/landings/it;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# it.mana.how — European Tech Independence
+server {
+    listen 80;
+    server_name it.mana.how;
+    root /srv/landings/it;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# chats.mana.how — Chat Landing
+server {
+    listen 80;
+    server_name chats.mana.how;
+    root /srv/landings/chat;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# pics.mana.how — Picture Landing
+server {
+    listen 80;
+    server_name pics.mana.how;
+    root /srv/landings/picture;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# zitares.mana.how — Zitare Landing
+server {
+    listen 80;
+    server_name zitares.mana.how;
+    root /srv/landings/zitare;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# presis.mana.how — Presi Landing
+server {
+    listen 80;
+    server_name presis.mana.how;
+    root /srv/landings/presi;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# clocks.mana.how — Clock Landing
+server {
+    listen 80;
+    server_name clocks.mana.how;
+    root /srv/landings/clock;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# manadeck.mana.how — ManaDeck Landing
+server {
+    listen 80;
+    server_name manadeck.mana.how;
+    root /srv/landings/manadeck;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# nutriphi.mana.how — NutriPhi Landing
+server {
+    listen 80;
+    server_name nutriphi.mana.how;
+    root /srv/landings/nutriphi;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# citycorners.mana.how — CityCorners Landing
+server {
+    listen 80;
+    server_name citycorners.mana.how;
+    root /srv/landings/citycorners;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}
+
+# docs.mana.how — Documentation
+server {
+    listen 80;
+    server_name docs.mana.how;
+    root /srv/landings/docs;
+    index index.html;
+    include /etc/nginx/snippets/landing-common.conf;
+}

docker/nginx/snippets/landing-common.conf

@@ -0,0 +1,24 @@
+# Common settings for all landing page server blocks
+
+# Security headers
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+# Cache static assets aggressively (Astro hashes filenames)
+location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot|webp|avif)$ {
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+}
+
+# SPA fallback: try file, then directory, then index.html
+location / {
+    try_files $uri $uri/ $uri/index.html /index.html;
+}
+
+# Health check
+location /health {
+    access_log off;
+    return 200 "healthy\n";
+    add_header Content-Type text/plain;
+}