[forgejo] Restore registry-private temporarily until image migration completes

The Phase 4 docker-compose + nginx changes I landed earlier dropped
the registry-private container's port-5050 listener BEFORE migrating
the existing images to Forgejo. The registry-config-sync pipeline
applied the new nginx config, breaking pulls from registry-private —
which is the source of every image we still need to copy to Forgejo.

Restore registry-private + the 5050 listener until the migration
script has finished. Subsequent commit will drop them once images
are confirmed in Forgejo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

modules/docker-registry/nginx_registry.conf

@@ -33,9 +33,16 @@ http {
         keepalive 32;
     }
 
-    # `upstream private` removed in Phase 4 of forgejo-registry-consolidation
-    # 2026-05-07. The /v2/ private registry is now Forgejo at
-    # forgejo.viktorbarzin.me/viktor/.
+    # `upstream private` is being kept TEMPORARILY during Phase 3+4 of
+    # forgejo-registry-consolidation 2026-05-07 — registry-private is the
+    # source of every image we still need to migrate to Forgejo. Drop this
+    # block and the port-5050 server below in the SAME commit that runs the
+    # final `docker compose up -d --remove-orphans` to stop the
+    # registry-private container.
+    upstream private {
+        server registry-private:5000;
+        keepalive 32;
+    }
 
     # --- Docker Hub (port 5000) ---
 
@@ -167,8 +174,41 @@ http {
         }
     }
 
-    # --- Private R/W Registry (port 5050) removed Phase 4 2026-05-07 ---
-    # The TLS port 5050 server block previously fronted `registry-private`.
-    # Migrated to Forgejo at forgejo.viktorbarzin.me/viktor/. nginx no longer
-    # listens on 5050; docker-compose.yml drops the `5050:5050` port mapping.
+    # --- Private R/W Registry (port 5050, TLS) ---
+    # KEPT TEMPORARILY during Phase 3+4 of forgejo-registry-consolidation
+    # 2026-05-07 to allow the orphan-image migration script to pull images
+    # off this registry one last time. To remove: drop this server block,
+    # the upstream `private` block above, and the 5050:5050 port mapping
+    # in docker-compose.yml — all in the same commit.
+    server {
+        listen 5050 ssl;
+        server_name registry.viktorbarzin.me;
+
+        ssl_certificate /etc/nginx/tls/fullchain.pem;
+        ssl_certificate_key /etc/nginx/tls/privkey.pem;
+        ssl_protocols TLSv1.2 TLSv1.3;
+
+        client_max_body_size 0;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        chunked_transfer_encoding on;
+
+        location /v2/ {
+            proxy_pass http://private;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header Connection "";
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            proxy_read_timeout 900;
+            proxy_send_timeout 900;
+        }
+
+        location / {
+            return 200 'ok';
+            add_header Content-Type text/plain;
+        }
+    }
 }