feat: proxy path prefix and proxied dashboard support

[grunjol]

Adds support for Hermes deployments behind a reverse proxy where the
Gateway API and Dashboard share the same host/port but sit under
different URL paths (e.g. /profile/peter/v1/ for chat,
/dashboard/api/ for dashboard).

Changes

• SavedConnection: new fields gatewayPrefix, dashboardPrefix,
  and dashboardProxied to configure custom API paths and proxy mode.

• joinBaseUrl(): normalizes a base URL with an optional path
  prefix, used by both ApiClient and DashboardClient.

• ApiClient: accepts optional pathPrefix parameter so all REST
  calls (sessions, messages, health, chat completions) go through the
  correct proxy path.

• DashboardClient: accepts pathPrefix and proxied parameters.
  When proxied is true, skips SPA session-token auto-discovery and
  sends clean HTTP requests — the proxy injects Authorization: Bearer.

• UI: adds an "Advanced / Proxy Settings" collapsible section to
  the connection dialog with fields for gateway path prefix, dashboard
  path prefix, and a "Dashboard behind proxy" toggle.

[rusty4444]

Hermes Agent Review

Verdict: Changes requested.

I checked out the PR locally and ran:

• flutter pub get
• flutter test test/connection_manager_test.dart — all 31 tests passed
• flutter analyze — no issues found

Blocking issue:

• lib/core/services/connection_manager.dart:560-567 — DashboardClient._authHeaders() checks _usesPasswordAuth before _proxied, so a saved connection with dashboardProxied: true and non-empty dashboard credentials will still call /auth/password-login and send a session cookie. That contradicts the new UI copy (“Nginx injects auth — app sends clean requests”) and can break proxied deployments where auth is injected upstream. Please make proxied mode take precedence over password/open-dashboard auth, or prevent/purge dashboard credentials when proxied mode is enabled. Add a regression test covering proxied: true with non-empty username/password.

Non-blocking notes:

• Path-prefix URL normalization is covered by tests and looks good.
• Serialization/backward compatibility coverage for the new fields is good.

I did not merge this PR: it has no visible CI checks, and this automation only merges PRs with non-empty, all-successful status checks.

[rusty4444]

Hermes Agent Review

Approved after follow-up fixes.

I reviewed the updated PR and pushed a follow-up commit (a792965) that fixes the previously blocking proxied-auth issue and the remaining path-prefix call sites:

• ChatScreen now passes the saved gateway path prefix to ApiClient, so existing chat history and streaming completions use the proxy path.
• API-key validation now uses the configured gateway prefix.
• Dashboard validation and all drawer screens now use dashboard prefix/proxied mode consistently.
• The Dashboard / Proxy settings dialog can edit gateway prefix, dashboard prefix, proxied mode, port, and credentials after a connection is created.
• README and version were updated for v1.0.8.

Verification run locally:

• flutter pub get
• flutter analyze --fatal-infos — no issues
• flutter test — all tests passed
• flutter build apk --release --split-per-abi — built all three release APKs
• apksigner verify --print-certs — all APKs signed with the stable Hermes Android release cert (SHA-256 0710e9dfe1eef9ab15906433878d8c3dd14e141d554fc57b66acc7e4ced302a3)

No remaining blockers found.