fix(proxy): strip Node-RED ingress bases

Keep the two external ingress flows at /in/public and /in/kiosk while allowing Node-RED routes to stay path-local, such as /test1.

CLAUDE.md

@@ -68,6 +68,10 @@
     - public `/in/public/*` `/s/*` — rate-limited
     - kiosk-key `/api/kiosk/*` `/in/kiosk/*` `/dash/*` (kiosks)
     - admin session+TOTP `/admin/*` `/api/admin/*` `/nrdp/*` `/dash/*` (humans)
+    Node-RED external HTTP-in has exactly two ingress bases: `/in/public/*`
+    for user webhooks/actions and `/in/kiosk/*` for kiosk-authenticated data.
+    Angie strips that base before proxying, so a Node-RED route `/test1` is
+    called as `/in/public/test1` or `/in/kiosk/test1`.
 11. **labels** = routing primitive. cams+layouts+kiosks carry labels. 2 binding kinds:
     - `consume`: any kiosk w/label may render
     - `operate`: exactly ONE kiosk authoritative (composite PK incl role)

deploy/README.md

@@ -35,6 +35,15 @@ Node-RED is reachable only through:
 http://<pi-ip>/nrdp/
 ```
 
+Node-RED HTTP-in routes have two public base URLs:
+
+- Public webhook/user actions: `http://<pi-ip>/in/public/<node-red-path>`
+- Kiosk-authenticated ingress: `http://<pi-ip>/in/kiosk/<node-red-path>`
+
+For example, a Node-RED `http in` node at `/test1` is called as
+`http://<pi-ip>/in/public/test1` for public traffic, or
+`http://<pi-ip>/in/kiosk/test1` for kiosk-authenticated traffic.
+
 Do not publish `18080`, `18081`, `18082`, or `1880` on the host.
 
 If migrating from an older native install, stop the old host daemons first:

deploy/angie/betterframe.docker.conf

@@ -75,13 +75,13 @@ server {
 
     location /in/public/ {
         limit_req zone=bf_public burst=20 nodelay;
-        rewrite ^/in/public/(.*) /public/$1 break;
+        rewrite ^/in/public/(.*) /$1 break;
         proxy_pass http://betterframe_nodered;
     }
 
     location /in/kiosk/ {
         auth_request /api/kiosk/_check;
-        rewrite ^/in/kiosk/(.*) /kiosk/$1 break;
+        rewrite ^/in/kiosk/(.*) /$1 break;
         proxy_pass http://betterframe_nodered;
     }