fix: route Claude API through backend instead of nginx envsubst

- Add Claude API proxy in mock-backend.js (reads ANTHROPIC_API_KEY from env)
- Supports SSE streaming via pipe
- Move ANTHROPIC_API_KEY to backend service in docker-compose.demo.yml
- Remove envsubst from entrypoint (no longer needed)
- nginx-demo.conf proxies /aiui/api/claude/ to backend

This fixes the 401 error when Portainer doesn't pass env vars to
nginx correctly — the Node.js backend reads process.env directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/docker/docker-entrypoint.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
-# Substitute only ANTHROPIC_API_KEY in nginx config, leave nginx variables untouched
-envsubst '${ANTHROPIC_API_KEY}' < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
+# Copy nginx config (no envsubst needed — API key is handled by backend)
+cp /etc/nginx/nginx.conf.template /etc/nginx/nginx.conf
 exec nginx -g 'daemon off;'

neode-ui/docker/nginx-demo.conf

@@ -78,22 +78,15 @@ http {
             }
         }
 
-        # Proxy Claude API requests from AIUI to Anthropic
+        # Proxy Claude API requests to backend (which handles API key + streaming)
         location /aiui/api/claude/ {
-            rewrite ^/aiui/api/claude/(.*)$ /$1 break;
-
-            proxy_pass https://api.anthropic.com;
-            proxy_ssl_server_name on;
-            proxy_set_header Host api.anthropic.com;
-            proxy_set_header x-api-key "${ANTHROPIC_API_KEY}";
-            proxy_set_header anthropic-version "2023-06-01";
-            proxy_set_header Content-Type "application/json";
-
-            # SSE streaming support
+            proxy_pass http://neode-backend:5959;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
             proxy_buffering off;
             proxy_cache off;
             proxy_read_timeout 300s;
-            proxy_http_version 1.1;
             proxy_set_header Connection "";
         }