Fix Durable Options History Routing

Summary

Options tape history now has a durable public route through same-origin deployments. The live Nginx Proxy Manager route was updated to include /history/*, deployment checks now fail when required API paths reach the web app, and the tape UI surfaces older-history load failures instead of leaving the user to infer that only the hot window exists.

Changes Made

• Added scripts/check-public-api-routes.ts and the check:public-api-routes package script.
• Updated scripts/deploy.ts so same-origin API deploy verification probes required public routes.
• Updated deployment/docker/README.md to include /history/* in same-origin proxy routing and document the Nginx Proxy Manager regex.
• Added an options tape warning banner for live /history/options load errors.
• Updated live Nginx Proxy Manager config for flow.deltaisland.io so the public route regex includes history.
• Created follow-up Beads issue islandflow-qd7 for the later api.flow.deltaisland.io migration.

Context

The API and ClickHouse path already supported older options history, but the public same-origin route sent /history/options to the Next.js app. That made the live tape feel capped at the newest hot-window rows even though durable history existed behind the API.

Important Implementation Details

The deploy smoke check performs GET probes and verifies JSON responses for these same-origin routes:

/prints/options
/history/options
/replay/options
/nbbo/options
/ws/live

The live proxy matcher is now:

^/(ws|replay|prints|joins|nbbo|dark|flow|candles|history)/

Expected Impact for End-Users

Users on /tape can scroll beyond the initial options hot window and receive older ClickHouse-backed rows through the same cursor path for Signal and All prints. If public routing regresses, the tape now shows a visible history loading failure.

Validation

• Passed: bun test apps/web/app/terminal.test.ts
• Passed: bun test
• Passed: bun --cwd=apps/web run build
• Passed: bun run check:public-api-routes
• Passed: remote Nginx syntax check after updating the route.

Issues, Limitations, and Mitigations

• The long-term API subdomain migration remains separate work. Mitigation: tracked as islandflow-qd7.
• The Nginx Proxy Manager database and generated proxy host file were both updated because the existing live file had prior generated-file edits. Mitigation: deployment docs now call out the durable advanced-config/API path.

Follow-up Work

Complete islandflow-qd7 to move production API traffic to api.flow.deltaisland.io deliberately, including DNS, proxy behavior, CORS/websocket checks, docs, and deployment verification.