feat: add Nginx reverse proxy for robust CORS handling

Replace direct host port mapping with an Nginx reverse proxy that properly
handles CORS for any origin, including Obsidian's app://obsidian.md.

- docker-compose.yml: Add nginx service on port 8666, route to internal
  chroma:8000. Remove CORS env var from ChromaDB (handled by proxy now).

- nginx.conf (new): Minimal alpine config with permissive CORS headers,
  preflight OPTIONS handling, and streaming support (proxy_buffering off).

This fixes cross-origin access from remote Obsidian clients connecting over
Tailscale or VPN.

docker-compose.yml

@@ -1,15 +1,24 @@
 services:
   chroma:
     image: chromadb/chroma:latest
-    ports:
-      - '8666:8000'
+    expose:
+      - '8000'
     environment:
       - CHROMA_SERVER_HOST=0.0.0.0
       - CHROMA_SERVER_HTTP_PORT=8000
-      - CHROMA_SERVER_CORS_ALLOW_ORIGINS=["*"]
     volumes:
       - chroma_data:/chroma/chroma
     restart: unless-stopped
 
+  nginx:
+    image: nginx:alpine
+    ports:
+      - '8666:8666'
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - chroma
+    restart: unless-stopped
+
 volumes:
   chroma_data: