Crenel v0.4.1 — nginx read-path fix (F1)
Closes the nginx false-ENFORCED read-path bug (F1): an http-wrapped nginx.conf, a stream-only (L4) config, an include-only main file, or a map/upstream-only helper previously read as default-deny ENFORCED with zero routes and zero warnings. normalize now declares any unrecognized non-server block as a server_not_read unknown, so DenyState() downgrades to UNKNOWN. Legit bare-server{} fragments still read fully-parsed/ENFORCED.