feat: support cross-origin WebSocket proxy for remote gateway

- Add nginx /gwproxy/ reverse proxy with correct Origin header
- Auto-detect cross-origin gateway URL in GatewayClient.connect()
- Detect path-based proxy deployment in LoginScreen getInitialUrl()
- Change nginx/Docker to listen on port 3000, use host network mode

nginx.conf

@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 3000;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;
@@ -10,24 +10,35 @@ server {
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
 
+    # WebSocket reverse proxy — relay to remote gateway with correct Origin
+    location ~ ^/gwproxy/(.+) {
+        resolver 8.8.8.8 valid=30s;
+        proxy_pass https://api.routin.ai/$1;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host api.routin.ai;
+        proxy_set_header Origin "https://api.routin.ai";
+        proxy_ssl_server_name on;
+        proxy_read_timeout 86400;
+        proxy_send_timeout 86400;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
     }
 
-    # Cache static assets (hashed filenames — safe to cache forever)
     location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
 
-    # Don't cache index.html (SPA entry point must always be fresh)
     location = /index.html {
         add_header Cache-Control "no-cache, no-store, must-revalidate";
         add_header Pragma "no-cache";
         add_header Expires "0";
     }
 
-    # Gzip
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;
     gzip_min_length 256;