fix: Add Nginx configuration update to CI/CD deployment

CRITICAL FIX for 502 Bad Gateway error:
- Green-Blue deployment was switching to new port (5004)
- But Nginx config was still pointing to old port (5003)
- Result: direct port access worked, but Nginx proxy returned 502

CHANGES:
1. deploy_gb.sh: Remove sudo calls (requires root credentials)
   - Script cannot use sudo without NOPASSWD configuration
   - Nginx update now handled by CI post-deploy script

2. .gitea/workflows/deploy.yml: Add Nginx update step after Green-Blue deployment
   - Read new active port from taxbaik_port file
   - Update /etc/nginx/sites-available/default proxy_pass
   - Validate Nginx syntax
   - Reload Nginx with new configuration
   - Runs as root (CI runner privilege) - no sudo needed

RESULT:
- Nginx always points to current active port
- 502 errors prevented
- Seamless zero-downtime Green-Blue deployment

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

deploy_gb.sh

@@ -103,10 +103,11 @@ if [ "$SUCCESS" = "false" ]; then
   exit 1
 fi
 
-# 6. Switch Traffic
+# 6. Switch Traffic (Nginx update handled by CI post-deploy script)
 echo "=== Switching Traffic to Port $TARGET_PORT ==="
 echo "$TARGET_PORT" > "$PORT_FILE"
 echo "✓ Traffic routed to $TARGET_PORT"
+echo "⚠️  Note: Nginx will be updated by CI post-deploy script (requires root)"
 
 # 7. Terminate Old App
 echo "=== Stopping Old App on Port $ACTIVE_PORT ==="