Requirement: no extra software beyond the regulated set. The web app is built in a Node stage and served by
nginx (:8080, /api → app, SSE unbuffered); the server override keeps it off (host nginx serves the bundle).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>