Fix/cloudflare 525 fallback ssl

[farrasrayhand]

Summary

Adds a self-signed fallback TLS certificate for custom domains during the pending SSL provision phase so Cloudflare Proxied domains (in Full / Full Strict mode) can complete TLS handshakes without hitting Error 525.

Motivation

When a newly created custom domain is proxied through Cloudflare (Orange Cloud) with SSL mode set to Full or Full (Strict), Cloudflare attempts a TLS handshake on port 443 with the origin server. Previously, OpenResty omitted a 443 server block for pending/unissued domains, falling back to ssl_reject_handshake on;, which caused Cloudflare to return Error 525 (SSL Handshake Failed) and prevented Let's Encrypt HTTP-01 challenge completion behind Cloudflare.

Related issue

#308

Changes

• packages/adapters/src/infra/nginx.ts:
  • Added ensureFallbackCert() helper to generate a fallback self-signed TLS certificate under _fallback/fullchain.pem when a real Let's Encrypt cert is not yet present on disk.
  • Updated registerRoute() so that when route.tls is true but real certs are not yet provisioned, OpenResty emits a listen 443 ssl; server block using the fallback cert alongside listen 80;.
  • Once Let's Encrypt issues the real cert, registerRoute() seamlessly replaces the fallback block with the official certificate.
• packages/adapters/src/infra/nginx.test.ts:
  • Added unit test pending SSL fallback TLS for Cloudflare proxy compatibility to verify that fallback 443 server blocks are properly generated for unprovisioned TLS routes.

Verification

bun test packages/adapters/src/infra/nginx.test.ts

# Output:
# ✓ pending SSL fallback TLS for Cloudflare proxy compatibility > generates fallback TLS server block when tls is true but cert does not exist yet

Checklist

• One change per PR — one bug, or one agreed feature, with nothing unrelated bundled in
• The diff is scoped — no reformatting or lint fixes on lines I wasn't otherwise changing
• A test fails without this change and passes with it (or I explained above why there isn't one)
• bun run test, bun run --cwd <workspace> lint, and bun format all pass locally
• I understand every line of this diff and can explain it in review