Serve API and website behind Caddy path prefixes

Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_website/nginx.conf

@@ -6,19 +6,12 @@ server {
     # Hashed build assets can be cached forever.
     location /assets/ {
         add_header Cache-Control "public, max-age=31536000, immutable";
-        try_files $uri @strip_prefix;
+        try_files $uri =404;
     }
 
+    # Single page app: always serve index.html.
     location / {
         add_header Cache-Control "no-cache";
-        try_files $uri @strip_prefix;
-    }
-
-    # The reverse proxy may forward requests with their path prefix
-    # (e.g. /website/assets/app.js). Drop leading segments until a file
-    # matches; everything else is the single page app.
-    location @strip_prefix {
-        rewrite ^/[^/]+(/.+)$ $1 last;
-        rewrite ^ /index.html last;
+        try_files $uri /index.html;
     }
 }