Fix nginx SNI for Cloudflare upstream TLS

Without proxy_ssl_server_name on, nginx connects to Cloudflare's IP
without SNI, triggering handshake_failure (alert 40). Cloudflare requires
SNI to route TLS to the correct origin.

servers/legion/k8s/gitea-runner/gitea-proxy.yaml

@@ -31,6 +31,9 @@ data:
         proxy_set_header CF-Access-Client-Id     "${CF_ACCESS_CLIENT_ID}";
         proxy_set_header CF-Access-Client-Secret "${CF_ACCESS_CLIENT_SECRET}";
 
+        # Send SNI so Cloudflare routes the TLS connection correctly.
+        proxy_ssl_server_name on;
+
         # Preserve Host so Gitea/CF edge routes correctly.
         proxy_set_header Host git.neuralplatform.ai;
 
@@ -58,7 +61,7 @@ metadata:
   name: gitea-proxy-secret
   namespace: ci
   annotations:
-    force-sync: "2026-05-05-initial"
+    force-sync: "2026-05-05-sni-fix"
 spec:
   refreshInterval: 1h
   secretStoreRef: