Bug 3 from the Digesta report: no published image was both a GPU-less
RunPod orchestrator and an admin GUI.

The cause was a split nobody had noticed: admin_router is the admin API
(POST /login, /admin/api/*), while the GUI PAGES — GET /admin, /login,
/admin/models … — live in frontproxy/ui_pages.py and were registered only
on the front app. An install running `uvicorn codai.api.app:app` as a pure
orchestrator therefore shipped the entire admin API with no way to reach
it: GET /admin answered 404 and GET /login 405, because only POST /login
existed. Reproduced both exactly before changing anything.

codai/api/app.py now registers those pages itself, against the same config
dir the admin API writes, so one image is orchestrator + GUI. Guarded: a
missing templates or config dir logs and leaves the API untouched, the
same contract the front has.

Verified: /admin 404->302 /login, GET /login 405->200, /admin/models and
/admin/runpod redirect to login, and under X-Forwarded-Prefix=/coderai the
redirect goes to /coderai/login. /healthz and /v1/models unaffected.

Bug 4 (the light app 500ing under X-Forwarded-Prefix) did NOT reproduce:
_ForwardedPrefixMiddleware is installed in this app and /coderai/healthz,
/coderai/v1/models and the GUI all answer correctly with the header set,
stripped or un-stripped. The reported 500 was most likely /admin itself
(404 before this fix) surfacing through their proxy.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>