docs: correct the reverse proxy pages against the socket, cookie, forwarded-header and startup code

[silentoplayz]

Summary

I compared the HTTPS overview, the Nginx, HAProxy and Nginx Proxy Manager pages and the Nginx tabs with the socket, cookie, forwarded-header and startup code.

• CORS_ALLOW_ORIGIN defaults to *, so leaving it unset cannot break WebSocket. The three "must set it" warnings are now hardening tips that say what does break connections: a value that omits the public origin.
• The web UI streams chat tokens over /ws/socket.io, not over the HTTP response, so proxy buffering cannot garble markdown in the browser. The directive stays, for API clients reading streamed responses.
• The overview now names the Socket.IO path and that the browser uses the WebSocket transport only by default (ENABLE_WEBSOCKET_SUPPORT=false switches to long-polling). It adds forwarded headers and FORWARDED_ALLOW_IPS, the session and OAuth cookies that lack Secure by default, and the 25-second ping that makes 24-hour WebSocket timeouts unnecessary. It also adds the missing upload cap behind client_max_body_size, the /health and /ready endpoints, and WEBSOCKET_MANAGER=redis for several instances.
• HAProxy: WebSocket does not need TLS, and the path method cannot work because there is no base path setting. X-CLIENT-IP is not read, and a /health check is added.
• Nginx Proxy Manager: the field to fill is WebUI URL, not Webhook URL.

Related issue or discussion

None.

Checklist

• I have reviewed the relevant documentation and matched the existing style.
• This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility.
• I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories.

Notes for reviewers

Sources on dev: config.py (CORS_ALLOW_ORIGIN, RAG_FILE_MAX_SIZE), socket/main.py (path, transports, ping settings), src/routes/+layout.svelte (client transports), and main.py (/ws mount, /health, /ready, session cookie). Also backend/start.sh (--forwarded-allow-ips; open-webui serve trusts every peer instead, open_webui/__init__.py), env.py (cookie flags, ping intervals), routers/files.py (the HTTP 413 check), utils/oauth.py (request.base_url fallback), src/lib/constants.ts and svelte.config.js (no base path), and General.svelte for the WebUI URL field. Proxy product syntax is unchanged except where noted.