Support reverse proxy path prefixes

[itsDNNS]

1|## Summary
2|
3|- add fail-closed base-path configuration and explicit trusted-prefix handling for mounted deployments
4|- make server-rendered, browser, module, manifest, and service-worker URLs path-prefix aware
5|- add real proxy and browser coverage for mounted application journeys
6|- simplify maintenance and test infrastructure while retaining the built-in registry and complete Windows artifact checks
7|- harden browser rendering, internal redirects, and the real-prefix test proxy; update the pypdf security floor
8|- document the supported reverse-proxy and platform-wrapper contracts
9|
10|## Validation
11|
12|- real Home Assistant Supervisor Ingress validation by @lennard0711 on commit 3cc2b4d: setup/login, dashboard, logout/login, Settings, module navigation, assets, redirects, and console/network checks passed through direct and externally proxied Home Assistant access
13|- corrected-head full browser E2E suite: 526 passed
14|- corrected-head complete non-E2E suite: 3532 passed, 2 skipped
15|- corrected-head focused security and contract suite: 254 passed
16|- corrected-head real-proxy, prefix, BNetzA, and SmokePing browser regressions: 7 passed
17|- pip-audit reported no known vulnerabilities after updating pypdf to 6.15.0
18|- hash-pinned Linux and Windows runtime locks reproduced byte-for-byte
19|- all 69 locale files remained synchronized
20|
21|Closes #781
22|