Switch Fly proxy to upstream keepalive pools (#337)

## Summary

- Replace per-request DNS resolution (variable-based `proxy_pass`) with static `upstream` blocks and `keepalive` connection pools
- Reuses TLS connections through the Tailscale tunnel instead of handshaking per request
- Add `mise run fly-reload` for nginx config reload without full redeploy (re-resolves upstream DNS)

## Trade-off

DNS is resolved at config load, not per-request. If Tailscale Ingress pods get new IPs (restart, reschedule), `mise run fly-reload` is needed. A Grafana alert will be added to detect this.

## Still TODO on this branch

- [ ] Grafana alert for upstream unreachable (triggers fly-reload reminder)
- [ ] Docs pass
- [ ] Deploy from branch and verify latency improvement
- [ ] Changelog fragment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #337

argocd/manifests/tailscale-operator-base/proxyclass.yaml

@@ -21,5 +21,9 @@ spec:
     pod:
       tailscaleContainer:
         image: docker.io/tailscale/tailscale:v1.94.2
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
       tailscaleInitContainer:
         image: docker.io/tailscale/tailscale:v1.94.2