Self-hosted installs no longer require direct access to the gateway port

Fixed a class of “cannot reach the API server” failures on fresh self-hosted installs. The web tier now proxies all API calls to the gateway internally, so the browser only needs to reach the web port. Browser-side network errors are also forwarded to the web container’s log, making install issues visible from docker compose logs instead of failing silently.

No action required for SaaS tenants. Self-hosted installs benefit on upgrade.