fix(llm): tunnel fallback through nginx for same-origin (no CORS)

Browser trace showed fallback-dev cascade failing with 'Failed to
fetch' on the live site. dev.flow-master.ai OPTIONS preflight returns
HTTP 400 from foreign origins and the POST response lacks
Access-Control-Allow-Origin, so the browser blocks direct
cross-origin calls.

Add nginx location /api/llm-fallback/ that rewrites to
/api/v1/llm/ and proxies to dev.flow-master.ai (same DNS resolver
pattern as the demo proxy). Frontend now hits both gateways
same-origin via canvas.flow-master.ai, no CORS preflight needed.
The canvas-issued JWT is forwarded as-is and dev accepts it
(verified by curl).

nginx.conf

@@ -63,6 +63,28 @@ server {
     proxy_buffering off;
   }
 
+  # LLM fallback: tunnel to dev.flow-master.ai's working LLM gateway as
+  # a same-origin endpoint. demo's llm-integration-service returns 503
+  # (no provider key); dev's returns real OpenAI-backed completions and
+  # accepts the canvas-issued JWT. Proxying same-origin sidesteps CORS
+  # preflight + missing Access-Control-Allow-Origin on dev.
+  location /api/llm-fallback/ {
+    set $upstream_dev "https://dev.flow-master.ai";
+    rewrite ^/api/llm-fallback/(.*)$ /api/v1/llm/$1 break;
+    proxy_pass $upstream_dev;
+    proxy_set_header Host dev.flow-master.ai;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_ssl_server_name on;
+    proxy_ssl_name dev.flow-master.ai;
+    proxy_http_version 1.1;
+    proxy_connect_timeout 8s;
+    proxy_send_timeout 25s;
+    proxy_read_timeout 25s;
+    proxy_buffering off;
+  }
+
   # SPA fallback to index.html for client-side routing.
   location / {
     try_files $uri $uri/ /index.html;