fix: persist verified iPhone certificate onboarding download

nginx.conf

@@ -7,6 +7,14 @@ server {
 
     client_max_body_size 16k;
 
+    # Public certificate-only onboarding profile lives in the persistent cert
+    # mount. Never expose that directory: it also contains the private key.
+    location = /hope-server.mobileconfig {
+        alias /etc/voice/certs/hope-server.mobileconfig;
+        default_type application/x-apple-aspen-config;
+        add_header Cache-Control "no-store";
+    }
+
     location = /token {
         proxy_pass http://127.0.0.1:8091/token;
         proxy_set_header Host $host;