added opt-in managed nginx/TLS container (ADR 0005, plan step 13): server.nginx.* config serves GitTally over HTTPS on hosts without a reverse proxy — two-phase startup (ACME webroot via certbot container, then full HTTPS config), daily certificate renewal with nginx reload, labelled container removed on shutdown; all failures are non-fatal, the plain HTTP server keeps running

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/test/kotlin/de/hoennig/gittally/config/ConfigLoaderTest.kt

@@ -120,6 +120,36 @@ class ConfigLoaderTest : FunSpec() {
             config.branches["release"]!!.buildCommand shouldBe "./mvnw -P release test"
         }
 
+        test("empty publicBaseUrl defaults to https://<nginx.serverName>/ when set") {
+            val dir = Files.createTempDirectory("gittally-test")
+            dir.resolve(".gittally.yml").toFile().writeText(
+                """
+                server:
+                  nginx:
+                    serverName: ci.example.org
+                """.trimIndent(),
+            )
+            loader.load(dir).server.publicBaseUrl shouldBe "https://ci.example.org/"
+        }
+
+        test("explicit publicBaseUrl wins over the nginx.serverName default") {
+            val dir = Files.createTempDirectory("gittally-test")
+            dir.resolve(".gittally.yml").toFile().writeText(
+                """
+                server:
+                  publicBaseUrl: https://other.example.org/
+                  nginx:
+                    serverName: ci.example.org
+                """.trimIndent(),
+            )
+            loader.load(dir).server.publicBaseUrl shouldBe "https://other.example.org/"
+        }
+
+        test("publicBaseUrl stays empty without an nginx.serverName") {
+            val dir = Files.createTempDirectory("gittally-test")
+            loader.load(dir).server.publicBaseUrl shouldBe ""
+        }
+
         test("toYaml serializes GitTallyConfig with all sections") {
             val yaml = loader.toYaml(GitTallyConfig())
             yaml shouldContain "server:"