Proxy kiwix-serve through this app instead of linking to it directly

map.priesol.net sits behind a reverse proxy that only forwards to
maptool itself, so the previous approach (publish kiwix-serve's port,
link the browser straight at it) had no address a real browser could
ever reach — not just a Docker-internal hostname as first assumed, but
no host/port combination at all works from outside.

GET /kiwix/* now proxies to kiwix-serve (Kiwix.proxy in
lib/maptool/kiwix.rb, a plain Net::HTTP passthrough), and the kiwix
service runs with --urlRootLocation=/kiwix so every link/asset it
emits already carries that same prefix and needs no rewriting
(confirmed against libkiwix/internalServer.cpp, which strips this
exact prefix off incoming requests). Drops the port-publishing
approach from the previous commit entirely.

lib/maptool/kiwix.rb

@@ -1,12 +1,14 @@
 require "net/http"
 
 module Maptool
-  # A thin reachability check for an external kiwix-serve instance serving
-  # an offline Wikipedia ZIM (see docs/development.adoc for how to set one
-  # up) — the app itself never talks to it beyond this ping. Linking a POI
-  # popup to a geo search there (public/js/gpx.js) is a plain browser <a
-  # href> straight to kiwix-serve, not something this server proxies —
-  # kiwix-serve already has its own full search UI, no reason to rebuild it.
+  # A reachability check plus a passthrough proxy for an external
+  # kiwix-serve instance serving an offline Wikipedia ZIM (see
+  # docs/development.adoc for how to set one up). A POI popup's "Nearby on
+  # Wikipedia" link (public/js/gpx.js) used to point straight at
+  # kiwix-serve itself — fine on a LAN, broken once this app started
+  # running behind a reverse proxy (map.priesol.net) that only forwards to
+  # *this* app, leaving no address a browser could reach kiwix-serve at
+  # directly. GET /kiwix/* in app.rb calls .proxy below instead.
   module Kiwix
     def self.reachable?(url, open_timeout: 1, read_timeout: 2)
       return false if url.to_s.strip.empty?
@@ -17,5 +19,20 @@ module Maptool
     rescue StandardError
       false
     end
+
+    # path already carries the /kiwix prefix kiwix-serve itself expects
+    # (started with --urlRootLocation=/kiwix, see docker-compose.yaml) —
+    # this is a plain passthrough, not a rewrite, so its emitted links stay
+    # correct without this having to touch response bodies at all. Returns
+    # nil (halted as a 502 by the caller) rather than raising, same
+    # not-reachable-isn't-exceptional stance as .reachable? above.
+    def self.proxy(base_url, path, query_string, open_timeout: 2, read_timeout: 10)
+      uri = URI(base_url)
+      uri.path = path
+      uri.query = query_string unless query_string.to_s.empty?
+      Net::HTTP.start(uri.host, uri.port, open_timeout: open_timeout, read_timeout: read_timeout) { |http| http.request(Net::HTTP::Get.new(uri)) }
+    rescue StandardError
+      nil
+    end
   end
 end