map.priesol.net sits behind a reverse proxy that only forwards to maptool itself, so the previous approach (publish kiwix-serve's port, link the browser straight at it) had no address a real browser could ever reach — not just a Docker-internal hostname as first assumed, but no host/port combination at all works from outside. GET /kiwix/* now proxies to kiwix-serve (Kiwix.proxy in lib/maptool/kiwix.rb, a plain Net::HTTP passthrough), and the kiwix service runs with --urlRootLocation=/kiwix so every link/asset it emits already carries that same prefix and needs no rewriting (confirmed against libkiwix/internalServer.cpp, which strips this exact prefix off incoming requests). Drops the port-publishing approach from the previous commit entirely.