introduce separate weave-proxy service which holds the API key

This prevents opencode from having access to the `WEAVE_API_KEY` enviroment variable.

config/nginx/templates/default.conf.template

@@ -0,0 +1,11 @@
+server {
+  listen 80;
+  location / {
+    proxy_pass https://weave.redpencil.io;
+    proxy_ssl_server_name on;
+    proxy_set_header Host weave.redpencil.io;
+    proxy_set_header Authorization "Bearer ${WEAVE_API_KEY}";
+    proxy_buffering off;        # SSE streaming
+    proxy_read_timeout 600s;    # match opencode's 5-min defaults
+  }
+}