feat(gateway): add path_prefix for reverse-proxy deployments

[theonlyhennygod]

Summary

• Add optional gateway.path_prefix config field for deploying ZeroClaw behind a reverse proxy at a sub-path (e.g. /zeroclaw)
• All gateway routes are nested under the prefix via Router::nest(), with a trailing-slash redirect
• SPA fallback injects window.__ZEROCLAW_BASE__ into index.html so the frontend discovers the prefix at runtime
• Frontend files (api.ts, sse.ts, ws.ts, main.tsx, App.tsx, Sidebar.tsx) prepend basePath to all URLs
• Strict validation: must start with /, must not end with /, only URI-safe characters allowed

Review cleanup (vs original PR)

• Removed redundant .map(str::trim) in gateway/mod.rs — validation already rejects whitespace
• Ensured all existing tests have the new path_prefix field initialized

Adopted from #3709 by @slayer.
Supersedes #3709

Test plan

• Verify cargo check passes (confirmed locally, linker issue is Xcode-license-related, not code)
• Run cargo test for config schema validation tests (path_prefix accepts/rejects)
• Test gateway startup with path_prefix = "/zeroclaw" behind nginx/caddy reverse proxy
• Verify SPA loads correctly at the prefixed path
• Verify WebSocket and SSE connections work under the prefix

Risk

Medium — touches src/gateway/** (high-risk area) but changes are additive and opt-in behind a new config field. No existing behavior changes when path_prefix is unset.