Fix worker/gateway logic bugs and duplicate CORS headers

worker.py (both the ConfigMap copy and conf/worker.py):
- Set an explicit ack_wait=60s on the JetStream pull consumer. It was
  previously left at the implicit default (~30s), the same ballpark
  as the outbound HTTP timeout - a slow-but-legitimate external call
  could cause JetStream to redeliver the message to another worker
  while the first was still mid-request, double-processing a
  non-idempotent call (e.g. duplicate order creation).
- Track in-flight tasks and drain them (bounded wait) before closing
  the NATS/HTTP connections on shutdown, instead of cutting them off
  immediately - avoids dropped/duplicated messages on pod restarts.
- Generic exception handler now does nak(delay=5) instead of an
  undelayed nak(), avoiding a tight redelivery loop on a persistent
  bug.
- Missing 'data' field in a message now explicitly drops with a log
  line instead of silently forwarding the entire internal envelope.
- Removed the hardcoded NATS password fallback baked into the source
  (every deployment already supplies it via a Secret at runtime, so
  this was a redundant plaintext copy sitting in a ConfigMap).

app.py (both the ConfigMap copy and conf/app.py):
- Fixed "NATS by connected" typo -> "NATS not connected".
- Same hardcoded-password-fallback removal as worker.py.

CORS:
- conf/nginx-jupiter.conf and the in-cluster jupiter-cors-proxy nginx
  config both add their own CORS headers without stripping any the
  upstream might set, unlike nginx-queue-proxy.conf which does this
  correctly. Added proxy_hide_header for the ACA-* headers in both -
  browsers reject a response with duplicate Access-Control-* values.

docker-compose.yml:
- Added the missing doormile-proxy service (doormile.com -> :8206 ->
  NodePort 30830). nginx-doormile.conf existed but had no service
  wiring it into Traefik, unlike every other app.

docker-compose.yml

@@ -106,6 +106,27 @@ services:
       - "traefik.http.routers.atlantis-api.tls.certresolver=letsencrypt"
       - "traefik.http.services.atlantis-api.loadbalancer.server.port=8205"
 
+  # Doormile API Proxy (doormile.com -> K8s NodePort 30830)
+  doormile-proxy:
+    image: nginx:alpine
+    container_name: doormile-proxy
+    restart: unless-stopped
+    ports:
+      - "8206:8206"
+    volumes:
+      - ./conf/nginx-doormile.conf:/etc/nginx/nginx.conf:ro
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - web
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=web"
+      - "traefik.http.routers.doormile-api.rule=Host(`doormile.com`)"
+      - "traefik.http.routers.doormile-api.tls=true"
+      - "traefik.http.routers.doormile-api.tls.certresolver=letsencrypt"
+      - "traefik.http.services.doormile-api.loadbalancer.server.port=8206"
+
 networks:
   web:
     external: true