feat(infra): add nginx WebSocket proxy and SSH relay config to compose files

- Add WebSocket upgrade map to nginx and proxy /ws/ssh to poller:8080
- Update CSP connect-src to allow ws: and wss: for terminal connections
- Add tunnel port range 49000-49100, SSH relay env vars, ulimits, and healthcheck to poller in both override and prod compose files
- Increase poller memory limit to 512M in prod for tunnel/SSH overhead

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.override.yml

@@ -81,6 +81,20 @@ services:
       OPENBAO_TOKEN: dev-openbao-token
       POLL_INTERVAL_SECONDS: 60
       WIREGUARD_GATEWAY: wireguard
+      TUNNEL_PORT_MIN: 49000
+      TUNNEL_PORT_MAX: 49100
+      TUNNEL_IDLE_TIMEOUT: 300
+      SSH_RELAY_PORT: 8080
+      SSH_IDLE_TIMEOUT: 900
+      SSH_MAX_SESSIONS: 200
+      SSH_MAX_PER_USER: 10
+      SSH_MAX_PER_DEVICE: 20
+    ports:
+      - "127.0.0.1:49000-49100:49000-49100"
+    ulimits:
+      nofile:
+        soft: 8192
+        hard: 8192
     cap_add:
       - NET_ADMIN
     depends_on:
@@ -90,6 +104,11 @@ services:
         condition: service_healthy
       nats:
         condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget --spider -q http://localhost:8080/healthz || exit 1"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
     deploy:
       resources:
         limits: