feat(spore): add nginx reverse proxy for Open WebUI at chat.zx.dev (#331)

Proxy chat.zx.dev to glyph's Open WebUI instance over Tailscale with
TLS via the existing wildcard certificate and WebSocket support.
Authentication is handled by Open WebUI's built-in Pocket ID OIDC
integration rather than the oauth2-proxy layer.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

hosts/spore/services/homepage-dashboard.nix

@@ -97,6 +97,13 @@
               };
             };
           }
+          {
+            "Open WebUI" = {
+              description = "AI chat interface";
+              href = "https://chat.zx.dev";
+              icon = "open-webui";
+            };
+          }
           {
             "Jellyfin" = {
               description = "TV & movie streaming";

hosts/spore/services/web/default.nix

@@ -78,6 +78,14 @@
         useACMEHost = "zx.dev";
         locations."/".proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
       };
+      "chat.zx.dev" = {
+        forceSSL = true;
+        useACMEHost = "zx.dev";
+        locations."/" = {
+          proxyPass = "http://glyph.rove-duck.ts.net:8888";
+          proxyWebsockets = true;
+        };
+      };
       "jellyfin.zx.dev" = {
         forceSSL = true;
         useACMEHost = "zx.dev";