Consumer #700 / Admin #348 — nginx header buffers sized for the ALB cookie

ALB identity 400s. The header buffers were too small for the ALB session cookie and OIDC headers, and a 400 now names its own cause instead of being opaque. Consumer half is #700, admin half is #348. **Test (Tier 3):** only reproducible under whatever condition was producing the 400s, typically a large session cookie.