fix(deploy): force nginx sites-enabled symlink so config updates actually apply

Real 413 root cause on .116 and .228 turned out not to be the body-size
limit — their /etc/nginx/sites-enabled/archipelago was a stale regular
FILE, not a symlink to sites-available, so every nginx update since
someone froze the active config had been invisible to running nginx.
The /api/blob location, added at some point after that freeze, didn't
exist in sites-enabled, so every attachment upload hit nginx's default
1m client_max_body_size and returned 413 regardless of attachment
size.

Deploy now re-creates the symlink on every run: if sites-enabled is a
regular file or missing, we replace it with a symlink to
sites-available. Idempotent if it's already correct.

Also applied the fix live on all 4 fleet nodes — /api/blob now
responds 401 (session-auth required, as designed) instead of 413 on
2MB+ test uploads.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/deploy-to-target.sh

@@ -624,6 +624,15 @@ if [ "$LIVE" = true ]; then
       scp $SSH_OPTS "$NGINX_CFG" "$TARGET_HOST:/tmp/nginx-archipelago.conf" 2>/dev/null || true
       ssh $SSH_OPTS "$TARGET_HOST" '
         sudo cp /tmp/nginx-archipelago.conf /etc/nginx/sites-available/archipelago
+        # Make sites-enabled a symlink to sites-available so future
+        # config updates actually take effect. Older deploys left
+        # sites-enabled as a regular file that fell out of sync.
+        if [ -f /etc/nginx/sites-enabled/archipelago ] && [ ! -L /etc/nginx/sites-enabled/archipelago ]; then
+            sudo rm -f /etc/nginx/sites-enabled/archipelago
+            sudo ln -s /etc/nginx/sites-available/archipelago /etc/nginx/sites-enabled/archipelago
+        elif [ ! -e /etc/nginx/sites-enabled/archipelago ]; then
+            sudo ln -s /etc/nginx/sites-available/archipelago /etc/nginx/sites-enabled/archipelago
+        fi
         rm -f /tmp/nginx-archipelago.conf
       ' 2>/dev/null || true
     fi