Ship TLS nginx for backoffice, keep HTTP bootstrap until certs exist, proxy /monitoring to sentry-relay, and tunnel server/edge Sentry through Finland.
Single-job build/push/deploy plus nginx site install so self-hosted runners do not stall on multi-job graphs.
