nginx-knowledge-patch

# NGINX Knowledge Patch Baseline: NGINX Open Source through stable 1.26.x and mainline 1.27.1; covers batches `1.27.2`, `1.28.0`, `1.29.0`, `1.30.0`, and `1.31.0`, plus relevant FreeNginx 1.27/1.29 and NGINX Plus through R36. ## Reference index | Reference | Topics | | --- | --- | | [security-and-upgrades.md](references/security-and-upgrades.md) | CVEs, fixed-version boundaries, request hardening, unsafe legacy behavior | | [core-http-and-runtime.md](references/core-http-and-runtime.md) | listeners, core HTTP behavior, variables, filters, rate controls, builds | | [upstreams-and-proxying.md](references/upstreams-and-proxying.md) | keepalive, runtime DNS, balancing, retries, HTTP/2 backends, trailers, caches | | [tls-certificates-and-quic.md](references/tls-certificates-and-quic.md) | trust, OCSP, certificate loading and caches, ECH, TLS observability, QUIC | | [stream-mail-and-protocols.md](references/stream-mail-and-protocols.md) | stream TLS, mail proxying, PROXY TLVs, GeoIP2, MQTT, cross-module handoff | | [nginx-plus-operations.md](references/nginx-plus-operations.md) | support lifecycle, licensing, platforms, images, OIDC, ACME, API, key-value data | ## Select the product line first Treat NGINX Open Source, FreeNginx, and NGINX Plus as distinct product lines. Do not copy a FreeNginx-only directive into NGINX Open Source or assume a Plus-only directive exists in a standard build. This patch labels fork-specific and commercial features explicitly. ## Upgrade and secu...