Keep the Workspace load balancer HTTP-only

[cassi-volkova]

Summary

• replace the packaged default Nginx site only on the Workspace UI load balancer node set
• retain the internal port 80 catch-all while leaving public TLS termination to the site-specific edge
• validate the rendered component contract and document the ownership boundary
• prepare release version 0.4.3

Validation

• npm run typecheck
• npm run lint (passes with existing warnings)
• npm run test (393 web test files / 3,882 tests and 30 Electron tests)
• scripts/build-exordos-web-artifact.sh
• exordos build . --exordos-cfg-file exordos/exordos.yaml --output-dir output --force
• node scripts/validate-exordos-element.mjs output/exordos-elements
• git diff --check

[phantomii]

Approved. The public edge already terminates TLS and forwards Workspace traffic to the internal load balancer over HTTP; the new default site preserves that route and rejects only unmatched hosts.