feat: Z34b restore-by-host + harden web nginx DNS race

Add HMAC restore-by-host for phone-less rebind; resolve gateway at request time and recreate web after stack up.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -113,6 +113,7 @@ services:
   web:
     image: ${DOCKER_BASE_REGISTRY:-docker.m.daocloud.io/library}/nginx:1.27-alpine
     hostname: web
+    restart: unless-stopped
     depends_on:
       - gateway
     ports:
@@ -123,3 +124,7 @@ services:
       - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
     environment:
       TZ: Asia/Shanghai
+    networks:
+      default:
+        aliases:
+          - web