* feat(web): resolve a root-relative GITNEXUS_BACKEND_URL against the page origin
A GITNEXUS_BACKEND_URL of `/` (or `/prefix`) is injected as-is, and the
web client resolves it against the origin that served the page, so one
gitnexus-web deployment reaches its API on every hostname a reverse
proxy gives it. Protocol-relative values are left to the URL check and
rejected. Documents the two ways to route /api/* behind a proxy.
Closes#3593
* fix(web): reject a backslash-prefixed same-origin path
The URL parser reads a backslash as a slash, so `/\host` resolved against
the page origin became `http://host/`, an origin change. Both the server
check and the client resolution now treat it like `//host`.
* fix(web): keep a configured base ending in /api, and drop the unsupported direct route
normalizeServerUrl stripped a trailing /api from every URL, so a deployment
configured with GITNEXUS_BACKEND_URL=/proxy/api passed health and discovery
and then connected to /proxy/repo. The deployment's own base is now kept as
configured; the /api cleanup stays for hand-entered URLs. A regression covers
health, discovery and repository selection under /proxy/api.
The README no longer offers routing /api/* straight to `gitnexus serve` on a
public hostname: serve refuses to start with GITNEXUS_PUBLIC_ORIGIN set until
it has authentication of its own.
* fix(web): keep only a same-origin base as configured
The bypass in normalizeServerUrl matched any injected default, so an
absolute GITNEXUS_BACKEND_URL ending in /api would have produced a
doubled /api segment, and one carrying credentials would have kept them.
Only a root-relative deployment base is kept now; it is resolved from the
page origin, so it has neither. Absolute injected URLs are normalized as
before.
* docs: align resolution architecture and roadmap
* docs: add language ingestion gap inventories
* test: audit receiver gap targets and coverage
Check exact declaration IDs, expose the Dart await wrong-owner edge, and execute previously excluded C++, Rust, PHP, Dart and Vue shapes. Refresh the baseline and all language inventories from fresh measurements; call-drop counts remain unchanged.
* docs: focus roadmap and shorten project README
Keep the resolution roadmap limited to future work and acceptance criteria. Move detailed editor, CLI, MCP, deployment and wiki instructions into linked guides, preserve their command examples, and correct stale onboarding claims.
* docs: correct setup and audit descriptions
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
