Fix nginx deny-all shadowing the /storage public-file allow-list

[morcen]

What was broken

docker/nginx.conf had:

# Security: deny access to storage
location ^~ /storage {
    deny all;
}

# Allow specific storage paths for public files
location ~* /storage/.*\.(jpg|jpeg|png|gif|ico|svg|pdf)$ {
    expires 30d;
    add_header Cache-Control "public, no-transform";
}

The ^~ prefix modifier tells nginx to stop searching for a matching location and skip evaluating any regex locations once this prefix location is the longest match. Since /storage matched ^~ first, the regex allow-list right below it was never reached, so every request under /storage was denied with a 403 — including public files served from the public filesystem disk, such as Jetstream profile photos (profile_photo_disk = public in config/jetstream.php, served from APP_URL/storage).

What changed

• Removed the ^~ modifier from the /storage deny-all location in docker/nginx.conf. Without it, nginx still evaluates the regex allow-list location for allowed extensions (jpg/jpeg/png/gif/ico/svg/pdf) before falling back to the deny-all rule for anything else under /storage.
• Added tests/Feature/NginxStorageAccessTest.php, which parses the committed docker/nginx.conf (nginx doesn't run under the PHPUnit suite) and asserts the deny rule no longer uses ^~ while both the deny-all fallback and the extension allow-list still exist. This follows the same pattern as the existing NginxContentSecurityPolicyTest. Verified the new test fails against the pre-fix config and passes after the fix.

Test plan

• vendor/bin/pint --dirty — clean
• composer test (full PHPUnit suite) — 261 passed, 1 pre-existing skip
• Verified tests/Feature/NginxStorageAccessTest.php fails on the original ^~ /storage config and passes after the fix

Fixes #139