HLS su edge e monitoraggio ops con latenza p95.

Evita di saturare Puma in diretta, separa i check Rails/pubblico e traccia la latenza /up per alert più affidabili.

Co-authored-by: Cursor <cursoragent@cursor.com>

infra/nginx-edge/nginx.conf

@@ -14,6 +14,11 @@ http {
         ''      close;
     }
 
+    map $http_cookie $hls_cookie {
+        default $http_cookie;
+        ""      "cookieCheck=1";
+    }
+
     server {
         listen 80;
         server_name _;
@@ -44,6 +49,26 @@ http {
             proxy_set_header If-Range $http_if_range;
         }
 
+        # HLS live/regia: proxy diretto a MediaMTX (non passa da Puma).
+        location /hls/ {
+            limit_except GET HEAD {
+                deny all;
+            }
+
+            rewrite ^/hls/(.*)$ /$1 break;
+            proxy_pass http://mediamtx:8888;
+            proxy_http_version 1.1;
+            proxy_buffering off;
+            proxy_request_buffering off;
+            proxy_connect_timeout 5s;
+            proxy_read_timeout 3600s;
+            proxy_set_header Host $host;
+            proxy_set_header Cookie $hls_cookie;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
         location = /edge-health {
             access_log off;
             add_header Content-Type text/plain;