refactor(nginx): relocate templates to templates/ and harden proxy configuration

- Unify unix socket path to %docroot%/gunicorn.sock

- Add ^~ priority modifier for /static/ and /media/ locations

- Add complete proxy headers including X-Forwarded-Proto for CSRF compatibility

- Clean up root directory by placing templates in dedicated templates/ folder

templates/django-gunicorn.stpl

@@ -0,0 +1,76 @@
+#=========================================================================#
+# Django + Gunicorn Socket SSL Template for HestiaCP  (HTTPS)
+# Auto-generated by hestia-django-gunicorn deployment engine
+# Socket path: %docroot%/gunicorn.sock
+#=========================================================================#
+
+server {
+    listen      %ip%:%proxy_ssl_port% ssl http2;
+    server_name %domain_idn% %alias_idn%;
+
+    ssl_certificate      %ssl_pem%;
+    ssl_certificate_key  %ssl_key%;
+    ssl_stapling         on;
+    ssl_stapling_verify  on;
+
+    root        %docroot%;
+    index       index.html;
+
+    access_log  /var/log/%web_system%/domains/%domain%.log combined;
+    access_log  /var/log/%web_system%/domains/%domain%.bytes bytes;
+    error_log   /var/log/%web_system%/domains/%domain%.error.log error;
+
+    # Block access to hidden files (except .well-known for ACME)
+    location ~ /\.(?!well-known\/) {
+        deny all;
+        return 404;
+    }
+
+    # Static files — priority match prevents regex collision
+    location ^~ /static/ {
+        alias %docroot%/staticfiles/;
+        try_files $uri %docroot%/static/$uri =404;
+        expires 30d;
+        access_log off;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Media files (user uploads)
+    location ^~ /media/ {
+        alias %docroot%/media/;
+        expires 30d;
+        access_log off;
+        add_header Cache-Control "public";
+    }
+
+    # Proxy known static extensions directly (HestiaCP convention)
+    location ~* ^.+\.(%proxy_extensions%)$ {
+        try_files $uri @fallback;
+        root %docroot%;
+        expires max;
+        access_log off;
+    }
+
+    # Fallback to Gunicorn for unresolved static extension requests
+    location @fallback {
+        proxy_pass http://unix:%docroot%/gunicorn.sock;
+    }
+
+    # Main application — reverse proxy to Gunicorn unix socket
+    location / {
+        proxy_pass http://unix:%docroot%/gunicorn.sock;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_redirect off;
+
+        # Timeouts for long-running requests
+        proxy_connect_timeout 300s;
+        proxy_read_timeout 300s;
+    }
+
+    include %home%/%user%/conf/web/%domain%/nginx.hsts.conf*;
+    include %home%/%user%/conf/web/%domain%/nginx.ssl.conf_*;
+}