Serve API and website behind Caddy path prefixes

Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.

- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
  giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
  in addition to the shared secret
- Docs updated for the prefixed deployment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_website/vite.config.ts

@@ -7,11 +7,13 @@ export default defineConfig({
   // Relative asset URLs, so the app works under any path prefix (e.g. /website/).
   base: './',
   server: {
-    // Forward API requests (including the websocket) to a locally running game server.
+    // Forward API requests (including the websocket) to a locally running game
+    // server, stripping the prefix like the production reverse proxy does.
     proxy: {
       '/api': {
         target: process.env.WIZARD_SERVER_URL ?? 'http://localhost:8000',
         ws: true,
+        rewrite: (path) => path.replace(/^\/api/, ''),
       },
     },
   },