Proxy kiwix-serve through this app instead of linking to it directly

map.priesol.net sits behind a reverse proxy that only forwards to
maptool itself, so the previous approach (publish kiwix-serve's port,
link the browser straight at it) had no address a real browser could
ever reach — not just a Docker-internal hostname as first assumed, but
no host/port combination at all works from outside.

GET /kiwix/* now proxies to kiwix-serve (Kiwix.proxy in
lib/maptool/kiwix.rb, a plain Net::HTTP passthrough), and the kiwix
service runs with --urlRootLocation=/kiwix so every link/asset it
emits already carries that same prefix and needs no rewriting
(confirmed against libkiwix/internalServer.cpp, which strips this
exact prefix off incoming requests). Drops the port-publishing
approach from the previous commit entirely.

docker-compose.yaml

@@ -37,14 +37,10 @@ services:
       # actually being present: GET /api/kiwix pings it and just reports
       # unavailable if the container isn't up/reachable, same story as
       # every other optional-local-file feature (offline.pmtiles, etc).
-      # Server-side reachability check only — a browser on the LAN can't
-      # resolve this hostname, see KIWIX_PUBLIC_PORT below.
+      # Reached server-side only — production sits behind a reverse proxy
+      # that only forwards to maptool itself, so app.rb's GET /kiwix/*
+      # proxies to this instead of handing the browser this address.
       KIWIX_URL: "http://kiwix:8080"
-      # The host port kiwix's own ports: mapping below publishes it on —
-      # app.rb builds the browser-facing "Nearby on Wikipedia" link from
-      # whatever host the visitor used to reach maptool itself plus this
-      # port, since KIWIX_URL above is Docker-internal only.
-      KIWIX_PUBLIC_PORT: "8090"
     volumes:
       # Uploaded GPX files and the offline PMTiles extract — kept outside
       # the image so a rebuild/redeploy doesn't wipe them (see
@@ -93,11 +89,14 @@ services:
     # --port=8080 (its default) before appending this command array, so
     # passing it again produced "Unexpected argument: --port=8080,
     # --port=8080, /data/wikipedia.zim" and kiwix-serve refused to start.
-    command: ["/data/wikipedia.zim"]
-    # Published so browsers on the LAN can reach kiwix-serve's own search
-    # UI directly (see maptool's KIWIX_PUBLIC_PORT above) — 8090, not 8080,
-    # since 8080 is already taken by another container on this host.
-    ports:
-      - "8090:8080"
+    #
+    # --urlRootLocation=/kiwix makes every link/asset kiwix-serve itself
+    # emits (search results, article pages, its CSS/JS) carry a /kiwix
+    # prefix, matching where app.rb's GET /kiwix/* proxies requests in
+    # from (confirmed against libkiwix's internalServer.cpp: it strips
+    # this same prefix off incoming request paths, so both ends agree on
+    # it) — no ports: mapping needed, nothing outside the compose network
+    # ever talks to this container directly.
+    command: ["--urlRootLocation=/kiwix", "/data/wikipedia.zim"]
     volumes:
       - ./data/kiwix/wikipedia.zim:/data/wikipedia.zim