fix: resolve /license/validate 502s (stale upstream DNS) + non-JSON error crash

[man4ish]

Summary

Fixes the "Unexpected token '<', "<!DOCTYPE "... is not valid JSON" error
reported on webstudio.omnibioai.org's license activation screen.

Root cause (live-reproduced on the production router): auth-service
restarted independently of nginx-router. nginx's upstream auth { server auth-service:8001; } block resolves that hostname once, at startup —
after the restart it kept sending traffic to the container's old, dead IP.
Every /license/, /auth/, /roles/, /users/, /orgs/ request 502'd
for ~2 hours (03:43:54–05:41:52) for any real client that hit them.
session.js then made the failure mode confusing on top of that: it
called res.json() unconditionally, so the raw HTML error page surfaced
as an opaque SyntaxError instead of a readable message.

Changes

• docker/nginx-router.conf: applies the same resolver + variable-based
  proxy_pass pattern already used for billing-service to auth,
  workbench, lims, policy-engine, and hpc-policy-engine, so these
  five upstreams re-resolve DNS per-request instead of once at startup.
  rag, gateway, audit, control, and the rest are untouched (still
  static, out of scope). The resolver directive is hoisted to file/http
  context so it's shared by every server{} block, including
  control.omnibioai.org / lims.omnibioai.org, which previously had none
  at all — a straight copy-paste of the variable pattern into those blocks
  would have failed to start without this.
• src/ui/lib/web/session.js: adds a readJson() helper (never
  throws) and uses it in loginWithLicenseKey, getCurrentUser, and
  confirmOAuthLink. Preference order on failure: known reason code →
  backend-sent error/message/detail field → generic
  `<action> failed (${res.status})`. Real JSON error bodies from the
  backend are still surfaced, not swallowed.

Verification

• nginx -t clean against the real Docker network, before and after.
• docker compose up -d --no-deps --force-recreate nginx-router, then:
  • POST /license/validate → 200, application/json,
    {"valid":false,...,"reason":"invalid_key"} (was 502 HTML).
  • POST /auth/validate → 200, {"valid":false}.
• Watched the nginx error log for ~3.5 min post-recreate with a heartbeat
  probe every 30s (7/7 clean) — zero connect() failed recurrence for
  auth-service.

Known gap (not fixed here)

The pre-fix outage's full blast radius isn't reconstructable — the old
container's logs were deleted on --force-recreate (no log volume, no
shipping sidecar, and cloudflared's journal doesn't log per-request
status codes for origin-returned errors). Only one real external client
is confirmed from an incidental capture during diagnosis. Follow-up:
persist or ship nginx-router logs so a postmortem like this is
answerable after a recreate.

🤖 Generated with Claude Code