Migrate frontend edge runtime from Nginx to the shared Pingora gateway

[seonghobae]

Buyer/operability gap

The current protected/default branch still ships the LineageWeave frontend from an Nginx container (frontend/Dockerfile copies the SPA to /usr/share/nginx/html, installs frontend/nginx.conf, and rewrites Nginx runtime paths for non-root execution). This remains an active CWL-managed Nginx runtime after the organization-wide Pingora edge policy was merged.

Ownership

LineageWeave owns its SPA behavior, public routes, cache/security headers, deployment topology, and buyer-facing rollback contract. ContextualWisdomLab/pingora-gateway owns only the reusable Pingora transport/runtime. Do not duplicate Pingora implementation in LineageWeave and do not move LineageWeave domain routing/policy into the shared gateway repository.

Dependency

Do not pin an invented tag or digest. The migration becomes deployable only after ContextualWisdomLab/pingora-gateway publishes a real reviewed artifact/image with an immutable verified digest, or an accepted ADR chooses a managed CDN/framework-native static-hosting boundary that satisfies the no-CWL-managed-Nginx policy.

RED characterization required before replacement

Capture the exact current Nginx behavior through the production container path, including at least:

• SPA history fallback versus real 404 behavior;
• static asset MIME types;
• GET/HEAD behavior;
• ETag/conditional requests where currently emitted;
• cache and security headers;
• port/non-root behavior;
• liveness/readiness expectations used by deployment tooling;
• deep-link navigation to current frontend routes;
• error behavior for missing assets.

Do not treat Dockerfile/config string replacement as behavioral equivalence.

GREEN acceptance

• No active Nginx image/package/config/runtime path remains in the final LineageWeave deployment.
• The replacement consumes a versioned Pingora edge contract or an explicitly approved alternative hosting boundary.
• The runtime is non-root/read-only-root compatible and preserves current SPA behavior proved by the RED tests.
• Deployment/Compose/Kubernetes manifests, SECURITY/THREAT_MODEL, OPERABILITY/rollback, ARCHITECTURE/DDD Context Map, docs/product-technical-gap-baseline.md, README and CHANGELOG are code-current.
• Exact-head CI/security/coverage/package/SBOM/provenance checks pass; no predecessor-head evidence is reused.
• If an immutable shared gateway OCI image is consumed, the deployment pins the actually published digest, not a mutable tag.

DDD constraint

Keep the frontend experience and its route semantics in the LineageWeave bounded context. Pingora-specific transport objects belong only in the edge adapter/deployment boundary. Correct any obsolete nginx-named deployment directory/config path as part of the migration once the behavior is represented by the new edge contract; do not preserve misleading Nginx-era paths after consumer migration.