feat: per-instance NGINX — each node gets its own nginx binary and config

- Shared NGINX binary at /opt/wallarm/nginx/sbin/nginx (installed once)
- Each node gets /opt/wallarm/nodes/{name}/nginx/ with:
  - sbin/nginx (copied from shared)
  - conf/nginx.conf (per-instance, unique port + upstream)
  - logs/ (per-instance access/error logs)
- setup.sh runs with --custom-ngx-build (uses our nginx)

internal/native/native.go

@@ -101,7 +101,34 @@ WALLARM_CONFIG_PATH=%s
 		return fmt.Errorf("extract installer: %w\n%s", err, string(out))
 	}
 
-	// 6. Run setup.sh in batch mode
+	// 6. Set up per-instance NGINX config and binary
+	installNginx() // ensure shared NGINX binary exists
+	instanceNginx := filepath.Join(workDir, "nginx")
+	os.MkdirAll(instanceNginx+"/conf", 0755)
+	os.MkdirAll(instanceNginx+"/logs", 0755)
+	os.MkdirAll(instanceNginx+"/sbin", 0755)
+	exec.Command("cp", NginxDir+"/sbin/nginx", instanceNginx+"/sbin/nginx").Run()
+
+	nginxConf := instanceNginx + "/conf/nginx.conf"
+	os.WriteFile(nginxConf, []byte(fmt.Sprintf(`
+worker_processes auto;
+pid %s/nginx/nginx.pid;
+error_log %s/nginx/logs/error.log;
+events { worker_connections 10240; }
+http {
+    access_log %s/nginx/logs/access.log;
+    server {
+        listen %s;
+        location / {
+            proxy_pass http://%s;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+    }
+}
+`, workDir, workDir, workDir, listenPort(node.Address), upstreamAddr(node))), 0644)
+
+	// 7. Run setup.sh with custom NGINX build (uses our per-instance nginx)
 	setupScript := filepath.Join(workDir, "setup.sh")
 	if _, err := os.Stat(setupScript); err != nil {
 		return fmt.Errorf("setup.sh not found after extraction: %w", err)
@@ -111,6 +138,7 @@ WALLARM_CONFIG_PATH=%s
 		"--batch",
 		"--token", apiToken,
 		"--cloud", cloudFromHost(apiHost),
+		"--custom-ngx-build",
 	)
 	setupCmd.Dir = workDir
 
@@ -287,3 +315,19 @@ func cloudFromHost(host string) string {
 	}
 	return "EU"
 }
+
+// listenPort extracts the port from an IP:Port address.
+func listenPort(addr string) string {
+	if idx := strings.LastIndex(addr, ":"); idx != -1 {
+		return addr[idx+1:]
+	}
+	return "80"
+}
+
+// upstreamAddr returns the upstream address from node metadata.
+func upstreamAddr(node state.Node) string {
+	if node.UpstreamIP != "" && node.UpstreamPort != 0 {
+		return fmt.Sprintf("%s:%d", node.UpstreamIP, node.UpstreamPort)
+	}
+	return "127.0.0.1:80"
+}