Quadlets captured from the live units on bob, with the real immutable tags
(0.1.44-ge06652a) rather than a placeholder, plus the hanzalova vhost that
mounts the relay on /relay-api/ of the existing name.
Verified end to end: /relay-api/health returns ok through the prefix, the
relay's nested /v1 routes answer 401 rather than 404 (so the strip reaches
them and they are genuinely protected), the remote's own /v1 is unaffected,
and the served SPA bundle now carries the origin-relative /relay-api base.
The vhost is committed because it is half the design: the relay only works
on a path because nginx strips the prefix, and a future kanban.l4ir.net
needs exactly this location block and nothing else.
d7c912c7f4
