Initial commit: Card Grader deployed to hippofam.com/cards

PWA card-grading app, deployed behind Nginx Proxy Manager on Unraid with
basic auth. Includes CARD_GRADER_BASE_PATH support for running under a
sub-path, and Docker/compose config for the Unraid deployment.

nginx/card-grader.conf

@@ -0,0 +1,43 @@
+# Reverse proxy for Card Grader. Replace card-grader.example.com below with
+# your actual subdomain, point an A record at your Unraid box's public IP
+# (or use a dynamic-DNS hostname if your ISP doesn't give you a static one),
+# and forward ports 80 + 443 on your router to the Unraid box.
+
+server {
+    listen 80;
+    server_name card-grader.example.com;
+
+    # certbot's webroot plugin needs this path reachable over plain HTTP to
+    # issue/renew the certificate; everything else redirects to HTTPS.
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name card-grader.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/card-grader.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/card-grader.example.com/privkey.pem;
+
+    # Grading uploads can be a few photos at once; app.py caps the combined
+    # decoded size at 12MB, and base64 inflates that by ~33% on the wire —
+    # give nginx enough headroom that it isn't the thing rejecting uploads.
+    client_max_body_size 20m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8778;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # Grading calls out to Anthropic and can take a while on Opus/careful
+        # effort; don't let nginx's default 60s read timeout cut it off.
+        proxy_read_timeout 120s;
+    }
+}