A self-hosted AI agent behind a per-user reverse proxy

A self-hosted AI agent's web UI under a per-user sub-path: trusted proxies, why frame refusal means a new tab, and one-time sign-in links instead of tokens.