- New docs/09-limits-and-performance.md: principles, all protection
layers, what players see, configuration reference, measurements,
tuning guide, monitoring and how to test
- Server chapter summarises the limits and links to chapter 9; circuit
breaker description and AI_MAX_INFLIGHT default corrected
- Architecture: new files in the layout, design decisions for load
handling; docs index lists chapter 9
- Protocol, AI and operations chapters link to chapter 9; test counts
- Root and component READMEs describe the limits and settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Caddy forwards /wizard/api/* and /wizard/website/* with the prefix
stripped, so the server received /ws instead of /api/ws and the website
connected to /api/ws on the domain root.
- Server routes are now /ws and /health (was /api/ws, /api/health)
- Website derives the websocket URL from its own location (../api/ws),
giving /wizard/api/ws in production and /api/ws in development
- Vite dev proxy strips /api like the production proxy
- nginx back to the plain SPA config since Caddy strips the prefix
- /internal/ai rejects requests that came through the reverse proxy,
in addition to the shared secret
- Docs updated for the prefixed deployment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
marvinandClaude Opus 5.5