v0.13.0 web and terminal client enhance, replay api, linux server deploy, doc and dependency update

deploy/nginx-chess.conf

@@ -0,0 +1,65 @@
+# nginx for chess: browsers (web and WASM clients) call <origin>/chess/api/...
+# and <origin>/chess/health, which map to the server's /api/... and /health;
+# /chess itself redirects to the project page. Replace <server-address> and
+# <port>: the FreeBSD jail's address and chessd_port, or 127.0.0.1 and
+# CHESSD_PORT for a Linux install on the same host (default port 8080).
+#
+# chess-server keys rate limits on X-Real-IP, trusted only from the addresses
+# in its trusted proxies (chessd_trusted_proxies or CHESSD_TRUSTED_PROXIES):
+# the address this nginx connects from, as the server sees it.
+# $remote_addr must be the real client: with PROXY protocol in front of nginx,
+# set real_ip_header proxy_protocol and set_real_ip_from for that hop.
+
+# --- http {} context ---
+upstream chess_api {
+    server <server-address>:<port>;
+    keepalive 16;
+}
+
+# --- TLS server {} context ---
+location /chess/api/ {
+    proxy_pass http://chess_api/api/;
+    proxy_http_version 1.1;
+    # Empty Connection header lets nginx reuse upstream keepalive connections.
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto https;
+
+    # Long-polling holds a request up to 30 seconds.
+    proxy_buffering off;
+    proxy_read_timeout 60s;
+    proxy_send_timeout 60s;
+
+    # API payloads are small JSON documents.
+    client_max_body_size 16k;
+}
+
+location = /chess/health {
+    proxy_pass http://chess_api/health;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_read_timeout 10s;
+}
+
+# Short link: /chess and /chess/ redirect to the page that embeds the client
+# (adjust /projects/chess/). 302 rather than 301: browsers cache a 301
+# indefinitely, which would loop if the direction is ever reversed. A server
+# listening on a non-default port (PROXY protocol or TLS passthrough behind a
+# front end) needs `absolute_redirect off;` so the port does not leak into
+# Location. If this server block also answers for other host names, guard with
+# a host map so only the main site redirects.
+location = /chess {
+    return 302 /projects/chess/$is_args$args;
+}
+location = /chess/ {
+    return 302 /projects/chess/$is_args$args;
+}
+
+# Everything else under /chess is not served by the API.
+location /chess/ {
+    return 404;
+}