Serve API and website behind Caddy path prefixes

Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_server/README.md

@@ -3,7 +3,8 @@
 FastAPI game server. It manages sessions, lobbies and games, and talks to the AI service.
 
 - `game_logic/` — the standalone rules engine (`pip install ./game_logic`, see its README).
-- `app/main.py` — routes: `GET /api/health`, `WS /api/ws` (browsers), `WS /internal/ai` (AI service)
+- `app/main.py` — routes: `GET /health`, `WS /ws` (browsers), `WS /internal/ai` (AI service,
+  refused when the request came through the reverse proxy)
 - `app/protocol.py` — client message schema
 - `app/service.py` — dispatches client messages, reconnects sessions, cleanup
 - `app/lobby.py` — lobbies, seats, host actions, running games and AI turns