fix: host nginx proxies /api to gateway to avoid web DNS 502

Public HTTPS API/AI/gateway go to 127.0.0.1:8180; web only serves static. Restores static gateway upstream inside the web container.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/lib-aijz-deploy.sh

@@ -112,8 +112,9 @@ install_host_nginx_site_conf() {
   [ "${AIJZ_ENABLE_HOST_NGINX:-0}" = "1" ] || return 0
   local tpl="$ROOT/nginx/aijz.host.conf"
   local out="/etc/nginx/conf.d/aijz_${domain}.conf"
-  local web_port
+  local web_port gw_port
   web_port="$(publish_host_port "${AIJZ_WEB_PUBLISH:-127.0.0.1:5173}")"
+  gw_port="$(publish_host_port "${AIJZ_GATEWAY_PUBLISH:-127.0.0.1:8180}")"
   [ -f "$tpl" ] || {
     echo "未找到 $tpl，跳过宿主机 Nginx 配置" >&2
     return 0
@@ -122,6 +123,7 @@ install_host_nginx_site_conf() {
   sync_ssl_certs
   sed -e "s|__DOMAIN__|${domain}|g" \
       -e "s|__WEB_PORT__|${web_port}|g" \
+      -e "s|__GATEWAY_PORT__|${gw_port}|g" \
       -e "s|__VERIFY_ROOT__|${ROOT}/verify-root|g" \
       "$tpl" | run_sudo tee "$out" >/dev/null
   if ! run_sudo nginx -t 2>/dev/null; then