feat(nginx): add /rag-originals/ location for QA PDF serving

Serves original regulation PDFs from ~/rag-originals/ on port 3002
for the RAG QA Split-View Chunk-Browser. Adds volume mount to nginx.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -76,6 +76,7 @@ services:
       - ./nginx/conf.d:/etc/nginx/conf.d:ro
       - vault_certs:/etc/nginx/certs:ro
       - ./nginx/html:/usr/share/nginx/html/portal:ro
+      - /Users/benjaminadmin/rag-originals:/data/rag-originals:ro
     depends_on:
       vault-agent:
         condition: service_started

nginx/conf.d/default.conf

@@ -248,6 +248,15 @@ server {
         proxy_set_header X-Forwarded-Proto https;
     }
 
+    # RAG Original-PDFs fuer QA Split-View
+    location /rag-originals/ {
+        alias /data/rag-originals/;
+        autoindex off;
+        types { application/pdf pdf; }
+        add_header Cache-Control "public, max-age=86400";
+        add_header X-Content-Type-Options nosniff;
+    }
+
     # Admin Lehrer Frontend (fallback for everything else)
     location / {
         set $upstream_admin_lehrer bp-lehrer-admin:3000;