Proxy kiwix-serve through this app instead of linking to it directly

map.priesol.net sits behind a reverse proxy that only forwards to
maptool itself, so the previous approach (publish kiwix-serve's port,
link the browser straight at it) had no address a real browser could
ever reach — not just a Docker-internal hostname as first assumed, but
no host/port combination at all works from outside.

GET /kiwix/* now proxies to kiwix-serve (Kiwix.proxy in
lib/maptool/kiwix.rb, a plain Net::HTTP passthrough), and the kiwix
service runs with --urlRootLocation=/kiwix so every link/asset it
emits already carries that same prefix and needs no rewriting
(confirmed against libkiwix/internalServer.cpp, which strips this
exact prefix off incoming requests). Drops the port-publishing
approach from the previous commit entirely.

app.rb

@@ -73,21 +73,13 @@ module Maptool
     # An external kiwix-serve instance (see docs/development.adoc), not
     # something this app runs itself — blank disables the "Nearby on
     # Wikipedia" popup link the same way the other optional-integration
-    # blanks above do. This is reached server-side only (the reachability
-    # check below, same-Docker-network service name in production, e.g.
-    # "http://kiwix:8080") — it is NOT what gets handed to the browser, see
-    # KIWIX_PUBLIC_PORT.
+    # blanks above do. Only ever reached server-side (the Docker-network
+    # service name in production, e.g. "http://kiwix:8080") — production
+    # sits behind a reverse proxy (map.priesol.net) that only forwards to
+    # this app, so a browser can't reach kiwix-serve directly by any
+    # hostname/port of its own. GET /kiwix/* below proxies to it instead.
     KIWIX_URL = ENV.fetch("KIWIX_URL", "")
 
-    # The port kiwix-serve is published on for browsers to reach directly
-    # (docker-compose.yaml's kiwix service ports: mapping) — KIWIX_URL above
-    # is a Docker-network-internal hostname a real browser can't resolve at
-    # all, so the "Nearby on Wikipedia" link is instead built from whatever
-    # host the visitor already used to reach maptool itself
-    # (request.host) plus this port. Blank disables the link, same as a
-    # blank KIWIX_URL.
-    KIWIX_PUBLIC_PORT = ENV.fetch("KIWIX_PUBLIC_PORT", "")
-
     # Login delegates to the Gitea instance the user already has an account
     # on, rather than maintaining a local username/password — see
     # docs/architecture.adoc. Only users listed in ALLOWED_GITEA_USERS may
@@ -218,16 +210,29 @@ module Maptool
       send_file TERRAIN_PMTILES_PATH, type: "application/octet-stream"
     end
 
-    # Pinged once per page load (public/js/map.js) — url is handed back so
-    # the frontend can build the geo-search link itself; this server never
-    # proxies to kiwix-serve, just says whether it's there. url is built
-    # from request.host (whatever hostname/IP the visitor already used to
-    # reach maptool itself) + KIWIX_PUBLIC_PORT, not KIWIX_URL — that's a
-    # Docker-network-internal address only this server can resolve.
+    # Pinged once per page load (public/js/map.js) — url is a same-origin
+    # path (not kiwix-serve's own address, which the browser can't reach
+    # directly behind the reverse proxy in front of this app), proxied by
+    # GET /kiwix/* below.
     get "/api/kiwix" do
       reachable = Kiwix.reachable?(KIWIX_URL)
-      url = KIWIX_PUBLIC_PORT.empty? ? "" : "http://#{request.host}:#{KIWIX_PUBLIC_PORT}"
-      json available: reachable && !url.empty?, url: url
+      json available: reachable, url: (reachable ? "/kiwix" : "")
+    end
+
+    # Proxies kiwix-serve's own search UI and content pages through this
+    # app instead of linking the browser to it directly (see KIWIX_URL) —
+    # kiwix-serve is started with --urlRootLocation=/kiwix
+    # (docker-compose.yaml), so every link/asset it emits already carries
+    # this same /kiwix prefix and Just Works through this passthrough. GET
+    # only: browsing a read-only ZIM archive never needs to write anything.
+    get "/kiwix/*" do
+      halt 404 if KIWIX_URL.empty?
+      response = Kiwix.proxy(KIWIX_URL, "/kiwix/#{params[:splat].first}", request.query_string)
+      halt 502 unless response
+
+      content_type response["content-type"] || "application/octet-stream"
+      status response.code.to_i
+      body response.body
     end
 
     get "/api/gpx/tree" do