chore(proxy): remove CPU/pids limits, add open_file_cache, fix nginx-sync symlink check

scripts/nginx-sync.sh

@@ -78,13 +78,24 @@ else
   if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
 fi
 
-if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then
+# sites-enabled/cms.conf must be a symlink, not a copy. A regular file here
+# silently shadows sites-available/cms.conf, so nginx keeps serving stale
+# config even though the sync updated sites-available.
+enabled="$NGINX_DIR/sites-enabled/cms.conf"
+if [[ -L "$enabled" && "$(readlink "$enabled")" == "../sites-available/cms.conf" ]]; then
+  echo "= $enabled symlink up to date"
+else
   if [[ "$MODE" == "check" ]]; then
-    echo "- sites-enabled/cms.conf missing"
+    echo "- $enabled is not the expected symlink"
     changed=1
   else
-    ln -sf ../sites-available/cms.conf "$NGINX_DIR/sites-enabled/cms.conf"
-    echo "+ linked sites-enabled/cms.conf"
+    mkdir -p "$NGINX_DIR/sites-enabled"
+    if [[ -e "$enabled" || -L "$enabled" ]]; then
+      mkdir -p "$BACKUP_DIR"
+      cp -a "$enabled" "$BACKUP_DIR/cms-enabled.conf"
+    fi
+    ln -sfn ../sites-available/cms.conf "$enabled"
+    echo "+ linked $enabled"
     changed=1
   fi
 fi