docs(portals): ADR-0034 — Caddy serves the portals (refs #166)

Records the decision, the directive-order footgun that shapes the Caddyfiles, and
the measured cost (the images grew 75.7 MB → 90.6 MB). Also updates the three
frontend-decisions entries and the two other docs that named nginx.

docs/architecture/adr-0032-werkbak-live-refresh.md

@@ -18,7 +18,7 @@ Three forces shape the mechanism:
 
 - **Nothing notifies anyone.** The trigger lives in Flowable. The domain does not publish
   task events, and there is no bus between the domain and the BFF.
-- **The BFF is stateless** and sits behind each portal's nginx.
+- **The BFF is stateless** and sits behind each portal's reverse proxy.
 - **This is the repo's first live-updating view**, so the choice sets a precedent.
 
 ## Decision
@@ -40,7 +40,7 @@ werkbak is readable at all.
 Neither buys freshness here, because **nothing notifies the BFF either**:
 
 - **SSE** (`text/event-stream`) would mean a new streaming endpoint whose handler polls the
-  domain and forwards diffs — the same latency, plus connection lifecycle, nginx
+  domain and forwards diffs — the same latency, plus connection lifecycle, proxy
   buffering, and auth on a long-lived connection.
 - **WebSocket/SignalR** adds a dependency (CLAUDE.md §13) and makes the BFF stateful and
   sticky-session-bound. A genuine push path would *also* need the domain to publish task