nginx: proxy /.well-known/cte-test-vectors.json to backend

Partners implementing CTEF v0.3 verifiers (APS, AgentID, MoltBridge,
Verascore, Concordia) fetch the published test vectors from this path
to cross-validate their JCS canonicalizer locally. Without this rule
nginx returns the SPA shell and partners see HTML instead of the
reference document.

Companion nginx rules exist for /.well-known/jwks.json,
/agent-trust.json, /webhook-test-vectors.json, /did.json.

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>

Author: kenneives

nginx/nginx.conf

@@ -130,6 +130,15 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        # CTEF v0.3 test vectors — deterministic JCS canonicalization reference
+        location /.well-known/cte-test-vectors.json {
+            proxy_pass http://backend:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
         # Bluesky feed generator — AT Protocol endpoints
         location /.well-known/did.json {
             proxy_pass http://backend:8000;