ci: build image + validate nginx on PRs; fix duplicate proxy_read_timeout

[ronibhakta1]

Problem

`ci.yml` runs lint/format/mypy/pytest on PRs, but the Docker image is only built in `deploy.yml` after merge to `main`. A broken Dockerfile, `uv.lock` or missing file would only surface during deployment.

Change

New `build` job in `ci.yml`, `needs: test` (skipped if tests fail):

• `docker compose config -q` validates the compose file.
• Builds the same Dockerfile `deploy.yml` pushes, with `push: false` and GHA layer cache.

Nothing is pushed or deployed from PRs. To make the check blocking, mark `build` as a required status check in branch protection.

Not covered

Runtime behaviour of the image (model downloads, ffmpeg at runtime).

Added: nginx config check + the fix it caught

Renders nginx/templates and runs nginx -t in nginx:alpine (throwaway cert). It failed on main with "proxy_read_timeout" directive is duplicate — the cause of the prod nginx crash — so this PR also carries the fix (formerly #34): proxy_read_timeout moves from the shared snippet to per-location (120s in /, 300s in /synthesize; effective values unchanged).