validate site config on the load balancers

Run nginx -t for this site config on every load balancer, in the context of its full live config. Writes nothing to any live directory.

Validates an nginx site config on EVERY load balancer in the nodes list and reports per node. The far side overlays the staged file on a shadow of its full live tree and runs the real nginx -t, so the answer covers certificates, includes and interactions with the other live sites : not a syntax check in a vacuum. Nothing reaches a live directory. This is a separate fan-out ahead of any write: 'does this validate everywhere' is answered in full before 'shall we replace anything' is asked. passed comes back true only when every node passed. results carries {name, host, ok, output, exit_code, checksum, site} per node, and checksum is a sha256 of the exact bytes checked: nginxsite_push demands a passing result with a MATCHING checksum for every node it is about to write to, so a flow cannot check, edit and then push a different file. Each node is {name, host, port, user, key_path, known_hosts_path}; user defaults to lbpush. Key MATERIAL must never appear on the pin : only paths : and the block refuses a node object carrying private_key, key, password, passphrase or secret.