Serve API and website behind Caddy path prefixes

Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_website/src/api/useWizard.ts

@@ -29,8 +29,12 @@ const CLOSE_REPLACED = 4000
 function websocketUrl(): string {
   const configured = import.meta.env.VITE_WS_URL as string | undefined
   if (configured) return configured
-  const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:'
-  return `${protocol}//${window.location.host}/api/ws`
+  // The API lives next to the website: /wizard/website/ -> /wizard/api/ws
+  // (and /api/ws in development).
+  const url = new URL('../api/ws', window.location.href)
+  url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:'
+  url.search = ''
+  return url.toString()
 }
 
 function readToken(): string | null {