🐛 Clear X-Forwarded-Host when proxying asset storage requests

[aznszn]

Summary

• Adds proxy_set_header X-Forwarded-Host ""; in the nginx asset proxy block
• Prevents the public-facing hostname from leaking through to S3/MinIO
• S3-compatible stores were honoring X-Forwarded-Host over the correctly-set Host header, causing thumbnail requests to be rejected or misrouted

Test plan

• Open a Penpot file with existing thumbnails — confirm they render
• Upload a new image asset — confirm thumbnail appears in the asset panel
• Check nginx/storage logs for no hostname mismatch errors

🤖 Generated with Claude Code