fix: resolve container backends dynamically to allow nginx startup

conf.d/10-resolver.conf.template

@@ -0,0 +1,5 @@
+# Docker's embedded DNS is available before the other stacks start.
+# Resolve container names at runtime so a missing backend cannot stop Nginx.
+# Requires Nginx >= 1.27.3 (open-source upstream resolve support).
+resolver 127.0.0.11 valid=10s;
+resolver_timeout 5s;