fix(api): route tenants through origin gateway

scripts/deploy/server-setup.sh

@@ -104,6 +104,18 @@ server {
         proxy_read_timeout 60s;
     }
 
+    # One same-origin gateway for bootstrap, auth, legacy and versioned APIs.
+    # The trailing slash removes /backend/ before forwarding upstream.
+    location /backend/ {
+        proxy_pass http://127.0.0.1:8080/;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+    }
+
     # SPA fallback. Must stay last: every unmatched path is a client route.
     location / {
         try_files $uri $uri/ /index.html;