Fix nginx templates (source of truth) + add reservedCount migration

The generated api.conf and services.conf we edited earlier were overwritten
at container startup by envsubst from *.template files. Fix the actual
templates:
- api.conf.template: X-Forwarded-For → $remote_addr, add limit_req
- services.conf.template: add frame-ancestors CSP after proxy_hide_header
- Add Prisma migration file for ticket_tiers.reserved_count

Bunker Admin

api/prisma/migrations/20260327100000_add_ticket_tier_reserved_count/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable: Add reserved_count for ticket overselling prevention
+-- Tracks pending Stripe checkout sessions to prevent concurrent overselling
+ALTER TABLE "ticket_tiers" ADD COLUMN "reserved_count" INTEGER NOT NULL DEFAULT 0;