Fix blackroad.systems domain configuration and Nginx setup

## Problem
The blackroad.systems domain was returning HTTP 403 Forbidden with a
fallback page ("Status: Nginx API") instead of serving the BlackRoad OS
application. This was caused by:

1. Domain configured in "forward" mode instead of DNS mode
2. Missing or misconfigured Nginx server blocks
3. Requests falling through to default server block

## Solution

### 1. Updated Domain Configuration (ops/domains.yaml)
- Changed blackroad.systems from "forward" to "dns" mode
- Domain now points directly to application server via CNAME
- Established blackroad.systems as canonical apex domain
- www.blackroad.systems redirects to apex domain (301)
- Aligns with DOMAIN_SPEC.md positioning as flagship corporate site

### 2. Created Nginx Configuration (ops/nginx/blackroad.systems.conf)
- Proper server_name directives for blackroad.systems
- HTTP to HTTPS redirects (301)
- www to apex domain redirects (301)
- Modern SSL/TLS configuration
- Security headers (HSTS, X-Frame-Options, etc.)
- SPA fallback routing with try_files
- Static asset caching with versioning
- Health check endpoint at /healthz
- Separate server blocks for apex and www subdomains

### 3. Deployment Guide (ops/DOMAIN_FIX_GUIDE.md)
- Step-by-step deployment instructions
- DNS configuration and verification
- SSL certificate setup
- Nginx deployment and testing
- Troubleshooting guide
- Post-deployment validation checklist

## Testing Required

After deployment:
1. Apply DNS changes: python3 ops/scripts/apply_domains.py
2. Deploy Nginx config to server
3. Obtain SSL certificates
4. Verify all redirects and endpoints
5. Purge CDN caches if applicable

## References
- blackroad-universe/domains/blackroad-systems/DOMAIN_SPEC.md
- ops/scripts/apply_domains.py

ops/domains.yaml

@@ -6,20 +6,26 @@
 #   - dns: set DNS records (CNAME or A)
 
 domains:
+  # Primary domain: blackroad.systems serves the main application
   - name: "blackroad.systems"
     type: "root"
     provider: "godaddy"
-    mode: "forward"
-    forward_to: "https://os.blackroad.systems"
-    forwarding_type: 301
+    mode: "dns"
+    record:
+      type: "CNAME"
+      value: "YOUR-PROD-RAILWAY-APP.up.railway.app"  # replace with your Railway host
+    notes: "Main flagship corporate site - serves BlackRoad OS application directly"
 
+  # www subdomain redirects to apex domain
   - name: "www.blackroad.systems"
     type: "subdomain"
     provider: "godaddy"
     mode: "forward"
-    forward_to: "https://os.blackroad.systems"
+    forward_to: "https://blackroad.systems"
     forwarding_type: 301
+    notes: "Redirects to canonical apex domain"
 
+  # os subdomain can be used as an alias
   - name: "os.blackroad.systems"
     type: "subdomain"
     provider: "godaddy"
@@ -27,6 +33,7 @@ domains:
     record:
       type: "CNAME"
       value: "YOUR-PROD-RAILWAY-APP.up.railway.app"  # replace with your Railway host
+    notes: "Alternative subdomain alias for the OS application"
 
   - name: "blackroad.ai"
     type: "root"