…#28086)

## What

Two fixes to the nginx reverse-proxy tutorial.

### `X-Forwarded-Proto` (line 137)
The config set:
```nginx
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
```
`$http_x_forwarded_proto` is the value of a client-supplied request
header, which a client can spoof and which is usually empty for a direct
request. In an nginx TLS-terminating reverse proxy this should be
`$scheme`, which nginx sets from the actual connection (`https`). Using
the raw client header can break Coder's scheme detection and
secure-cookie handling.

### Certbot link flavor (line 57)
The Certbot instructions link used `?ws=apache` in an nginx guide;
changed to `?ws=nginx` so readers get nginx instructions.

Surfaced by the runtime drift sweep; verified against `main`.

Linear:
[DOCS-642](https://linear.app/codercom/issue/DOCS-642/docs-fix-reverse-proxy-nginx-x-forwarded-proto-dollarscheme-certbot)

> This PR was created with AI assistance (Coder Agents).

(cherry picked from commit b0e93b6)