fix(deploy): detect the actually-live blue/green slot, stop nginx-sync clobbering the upstream

- ci-deploy.sh: read_active_port() now probes both slots on /api/health and
  picks the one that really answers; the upstream file only serves as a
  fallback when zero or both slots respond. A stray 'docker compose up' (or a
  clobbered snippet) can no longer derail the next deploy's cutover.
- nginx-sync.sh: cms_upstream_servers.conf is runtime-owned by ci-deploy.sh;
  only seed it when missing, never overwrite what a deploy wrote. This is the
  root cause of tonight's 502: a nginx-sync run reset the snippet (written to
  green:3003 by the last cutover) back to the dead slot A:3002.
- cms_upstream_servers.conf: restore the fresh-host seed default to slot A.

scripts/nginx-sync.sh

@@ -18,6 +18,8 @@
 #   nginx-cms.conf                            -> /etc/nginx/sites-available/cms.conf
 #   cloudflare-ips.conf                       -> /etc/nginx/conf.d/cloudflare-ips.conf
 #   cms_upstream_servers.conf                 -> /etc/nginx/snippets/cms_upstream_servers.conf
+#   (seed alleen als het bestand ontbreekt; zodra het bestaat is het runtime
+#    eigendom van scripts/ci-deploy.sh en wordt het hier nooit overschreven)
 #   symlink sites-enabled/cms.conf            -> ../sites-available/cms.conf
 set -euo pipefail
 
@@ -68,7 +70,13 @@ if install_file "$PROXY_DIR/nginx.conf" "$NGINX_DIR/nginx.conf"; then changed=1;
 if install_file "$PROXY_DIR/nginx-mime.types" "$NGINX_DIR/mime.types"; then changed=1; fi
 if install_file "$PROXY_DIR/nginx-cms.conf" "$NGINX_DIR/sites-available/cms.conf"; then changed=1; fi
 if install_file "$PROXY_DIR/cloudflare-ips.conf" "$NGINX_DIR/conf.d/cloudflare-ips.conf"; then changed=1; fi
-if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
+# De upstream-snippet is runtime-eigendom van ci-deploy.sh (blue/green): alleen
+# aanmaken op een verse host, nooit overschrijven wat een deploy heeft gezet.
+if [[ -f "$NGINX_DIR/snippets/cms_upstream_servers.conf" ]]; then
+  echo "= $NGINX_DIR/snippets/cms_upstream_servers.conf managed by ci-deploy.sh (untouched)"
+else
+  if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
+fi
 
 if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then
   if [[ "$MODE" == "check" ]]; then