feat: add app download

docker/waf/Dockerfile

@@ -0,0 +1,18 @@
+# WAF (Nginx + ModSecurity/OWASP CRS) — même pattern que
+# projet_gestion_commande/docker-prod/backend/Dockerfile (stage "waf") :
+# seul point de terminaison TLS + reverse-proxy devant web/api.
+FROM owasp/modsecurity-crs:nginx-alpine
+
+USER root
+
+RUN mkdir -p /var/log/modsec /etc/nginx/certs && \
+    chown -R nginx:nginx /var/log/modsec /etc/nginx/certs /usr/share/nginx/html
+
+COPY nginx.conf /etc/nginx/conf.d/app.conf
+COPY custom-rules.conf /etc/nginx/modsec/custom-rules.conf
+RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf && \
+    rm -f /etc/nginx/templates/conf.d/default.conf.template || true
+
+USER nginx
+EXPOSE 80 443
+CMD ["nginx", "-g", "daemon off;"]