feat(deploy): full one-line install with search API

Bundle static site, FastAPI search, nginx proxy, and systemd unit so
a fresh Ubuntu VPS can run curl install.sh and get /search working.

Co-authored-by: Cursor <cursoragent@cursor.com>

nginx/domain-web-api.conf

@@ -0,0 +1,11 @@
+# Domain Web API reverse proxy (included from domain-web.conf)
+location /api/ {
+    proxy_pass http://127.0.0.1:8081;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 300s;
+    proxy_connect_timeout 60s;
+}

nginx/domain-web.conf

@@ -1,14 +1,25 @@
-# PCA Lab / Domain Web — static site on port 80
-# Installed to /etc/nginx/sites-available/domain-web
+# PCA Lab / Domain Web — HTTP :80 (does not touch :443 / Amnezia)
+# Placeholders WEB_ROOT are replaced by install.sh
 
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
     server_name _;
 
-    root /var/www/domain-web;
+    root WEB_ROOT;
     index index.html;
 
+    # Clean URL for domain search
+    location = /search {
+        try_files /search.html =404;
+    }
+
+    location = /search.html {
+        return 301 /search;
+    }
+
+    include /etc/nginx/snippets/domain-web-api.conf;
+
     location / {
         try_files $uri $uri/ /index.html;
     }
@@ -18,7 +29,6 @@ server {
         add_header Cache-Control "public";
     }
 
-    # Do not proxy — Amnezia and other services stay on 443 separately
     access_log /var/log/nginx/domain-web-access.log;
     error_log /var/log/nginx/domain-web-error.log;
 }