✅ NGINX behind ALB (HTTPS handled by ACM)