fix: route Claude API through backend instead of nginx envsubst

- Add Claude API proxy in mock-backend.js (reads ANTHROPIC_API_KEY from env)
- Supports SSE streaming via pipe
- Move ANTHROPIC_API_KEY to backend service in docker-compose.demo.yml
- Remove envsubst from entrypoint (no longer needed)
- nginx-demo.conf proxies /aiui/api/claude/ to backend

This fixes the 401 error when Portainer doesn't pass env vars to
nginx correctly — the Node.js backend reads process.env directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/docker/docker-entrypoint.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
-# Substitute only ANTHROPIC_API_KEY in nginx config, leave nginx variables untouched
-envsubst '${ANTHROPIC_API_KEY}' < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
+# Copy nginx config (no envsubst needed — API key is handled by backend)
+cp /etc/nginx/nginx.conf.template /etc/nginx/nginx.conf
 exec nginx -g 'daemon off;'