fix nginx static assets under BASE_PATH sub-path

Regex cache-header locations (~* \.(css|js)$) used root directive,
which caused 404s when BASE_PATH is set (e.g., /test/css/app.css
looked for /usr/share/nginx/html/test/css/app.css). Moved regex
locations inside the alias block so they inherit the path stripping.
Also added healthz/ prefix match for liveness/readiness probes.

Tested with BASE_PATH=/test: health, login, CSS, JS all return 200.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nginx.conf.template

@@ -1,7 +1,6 @@
 server {
     listen 80;
     server_name _;
-    root /usr/share/nginx/html;
     index index.html;
 
     # Backend upstream (unified container: localhost:8080)
@@ -14,15 +13,6 @@ server {
     gzip_proxied expired no-cache no-store private auth;
     gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/javascript;
 
-    # Static assets — images/fonts get long cache; JS/CSS use revalidation
-    location ~* \.(jpg|jpeg|png|gif|ico|woff|woff2)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
-    location ~* \.(css|js)$ {
-        add_header Cache-Control "no-cache, must-revalidate";
-    }
-
     # ── API + WebSocket → backend ────────────
     location ^~ ${BASE_PATH}/api/ {
         proxy_pass $backend;
@@ -37,6 +27,10 @@ server {
         proxy_pass $backend;
     }
 
+    location ^~ ${BASE_PATH}/healthz/ {
+        proxy_pass $backend;
+    }
+
     location = ${BASE_PATH}/metrics {
         proxy_pass $backend;
     }
@@ -89,10 +83,20 @@ server {
         add_header Cache-Control "no-cache";
     }
 
-    # Fallback: serve frontend shell (SPA)
+    # ── Static assets (fallback) ──────────────
-    # alias strips the BASE_PATH prefix so /test/css/app.css → /usr/share/nginx/html/css/app.css
+    # alias strips BASE_PATH so /test/css/app.css → /usr/share/nginx/html/css/app.css
+    # Cache headers applied via nested locations inside the alias block
     location ${BASE_PATH}/ {
         alias /usr/share/nginx/html/;
+
+        location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+        }
+        location ~* \.(css|js)$ {
+            add_header Cache-Control "no-cache, must-revalidate";
+        }
+
         try_files $uri $uri/ /index.html;
     }