fix: proxy bare FastAPI paths through nginx (fixes 405 on POST /grader)

nginx.conf

@@ -26,7 +26,8 @@ http {
         root /app/ui/dist;
         index index.html;
 
-        # Proxy /api/* → FastAPI on :8000 (strip the /api prefix)
+        # Proxy /api/* → FastAPI on :8000 (strip the /api prefix).
+        # Used by the React UI (client.js calls /api/reset, /api/grader, etc.)
         location /api/ {
             proxy_pass         http://127.0.0.1:8000/;
             proxy_set_header   Host              $host;
@@ -35,6 +36,17 @@ http {
             proxy_read_timeout 120s;
         }
 
+        # Proxy bare FastAPI paths → FastAPI on :8000 (no prefix stripping).
+        # Used by the GRPO training script / notebook which calls /reset, /grader, etc.
+        # directly without the /api prefix.
+        location ~ ^/(reset|step|state|tasks|grader|baseline|forge|oversight)(/.*)?$ {
+            proxy_pass         http://127.0.0.1:8000;
+            proxy_set_header   Host              $host;
+            proxy_set_header   X-Real-IP         $remote_addr;
+            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+            proxy_read_timeout 120s;
+        }
+
         # Serve the Vite SPA — fall back to index.html for client-side routing
         location / {
             try_files $uri $uri/ /index.html;