Save in-progress keysat integration and StartOS 0.4 work

Snapshot of the working tree before cleanup. Captures:
- Keysat licensing: server/license.js, /api/license/* endpoints in
  server/index.js, activation modal in public/index.html, embedded
  Ed25519 issuer key (assets/issuer.pub).
- StartOS 0.4 expansion: setApiKey action, version files v0.1.1
  through v0.1.15, file-models/config.json.ts, manifest updates.
- Self-hosted registry server (startos-registry/).
- Build/deploy scripts (bin/bump-version.sh, bin/deploy.sh, vendored
  yt-dlp binary), .gitignore, .deploy.env.example.
- Recent design docs (KEYSAT_INTEGRATION.md, UPGRADE-DESIGN.md) —
  retained here so they remain recoverable when removed in the
  follow-up cleanup commit.

startos-registry/nginx.conf

@@ -0,0 +1,54 @@
+# /etc/nginx/sites-available/registry.satsflows.com
+#
+# nginx reverse proxy for the StartOS registry server.
+# Handles TLS termination via Let's Encrypt and proxies to Node.js on port 3030.
+
+server {
+    listen 80;
+    server_name registry.satsflows.com;
+
+    # Let's Encrypt ACME challenge
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Redirect everything else to HTTPS
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name registry.satsflows.com;
+
+    # TLS certificates (managed by certbot)
+    ssl_certificate /etc/letsencrypt/live/registry.satsflows.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/registry.satsflows.com/privkey.pem;
+
+    # Modern TLS settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    # s9pk files can be large (hundreds of MB)
+    client_max_body_size 500M;
+
+    # Longer timeouts for large file downloads
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+    proxy_connect_timeout 30s;
+
+    # Proxy to Node.js registry server
+    location / {
+        proxy_pass http://127.0.0.1:3030;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Disable buffering for large file streaming
+        proxy_buffering off;
+    }
+}