fix(nginx): defensive large_client_header_buffers bump (#591)

Default nginx is 4 8k — too tight when an outer Cloudflare /
corp-proxy injects long Set-Cookie / X-Forwarded-* headers, or when
a power-user accumulates many per-gallery gallery_token_<slug>
cookies over the 24h maxAge in tokenUtils.js. Either way users hit
"400 Request Header Or Cookie Too Large" and clearing cookies is
the only workaround.

4×32k is cheap RAM, matches what most reverse proxies do upstream,
and means PicPeak doesn't fail the request before the upstream even
sees it.

frontend/nginx.conf

@@ -24,6 +24,15 @@ server {
     client_max_body_size 1G;
     client_body_timeout 300s;
 
+    # Defensive header buffer bump (#591). Default `4 8k` is too tight when
+    # an outer Cloudflare / corp-proxy sits in front and injects long
+    # Set-Cookie / X-Forwarded-* headers, or when a power-user accumulates
+    # many per-gallery `gallery_token_<slug>` cookies over the 24h maxAge
+    # in tokenUtils.js. Either way users hit "400 Request Header Or Cookie
+    # Too Large" and clearing cookies is the only fix. 4×32k is cheap RAM
+    # and matches what most reverse proxies already do upstream.
+    large_client_header_buffers 4 32k;
+
     # Gzip compression
     gzip on;
     gzip_vary on;