Serve API and website behind Caddy path prefixes

Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_website/Dockerfile

@@ -6,8 +6,8 @@ COPY package.json package-lock.json ./
 RUN npm ci
 
 COPY . .
-# Optional absolute websocket URL of the game server, e.g. wss://api.example.com/api/ws.
-# By default the app connects to /api/ws on the host it was loaded from.
+# Optional absolute websocket URL of the game server, e.g. wss://game.example.com/wizard/api/ws.
+# By default the app connects to ../api/ws relative to the page URL.
 ARG VITE_WS_URL=
 ENV VITE_WS_URL=${VITE_WS_URL}
 RUN npm run build