fix(nginx): add public DNS fallback for upstream resolution

The in-cluster CoreDNS at 10.43.0.10 was returning empty for
demo.flow-master.ai, causing every /api/* proxy_pass to fail with
fast 502 (DNS resolution failure). Add 1.1.1.1 and 8.8.8.8 as
fallbacks so nginx can resolve public hostnames even when CoreDNS
doesn't forward external queries.

Lazy per-request resolution via $variable form preserved.

nginx.conf

@@ -19,11 +19,13 @@ server {
   add_header Cross-Origin-Resource-Policy "same-origin" always;
   add_header X-Robots-Tag "noindex, nofollow" always;
 
-  # Use the cluster CoreDNS resolver so upstream hostnames are resolved
-  # lazily (per-request), not at nginx startup. The proxy_pass targets below
-  # use $variable form to force this lazy resolution; otherwise nginx fails
-  # to start when cluster DNS is briefly unavailable (e.g. node recovery).
-  resolver 10.43.0.10 valid=30s ipv6=off;
+  # Use the cluster CoreDNS resolver for in-cluster Services AND public
+  # resolvers as fallback for external hostnames (demo.flow-master.ai etc.).
+  # k3s CoreDNS by default forwards external lookups, but if the forward
+  # is missing the proxy_pass to demo.flow-master.ai fails with 502/504.
+  # Listing public resolvers alongside ensures lookups succeed in both
+  # cases. Targets use $variable form to force lazy per-request resolution.
+  resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
 
   # Reverse-proxy /api to the demo backend so live mode is same-origin.
   location /api/ {