fix(stockholm): patch browser_http_proxy.js so the proxy URL respects basePath

Two patching gaps caused every Stockholm HTTP-proxy call from a
/stockholm/* page to hit /api/http-proxy (404) instead of the
basePath-prefixed /stockholm/api/http-proxy:

1. The proxy URL constant in browser_http_proxy.js is declared as
   `var PROXY_PATH` (uppercase). Our patch script only knew about the
   lowercase `var proxyPath` form used in app_comm.js, so it never
   matched the upstream file.

2. Even if the constant had matched, browser_http_proxy.js's IIFE
   evaluates the URL at script-load time — but the injected bootstrap
   that defines window.__stockholmBase is placed just before </head>,
   i.e. after the <script src=…> tags. The captured value would
   always fall back to the unprefixed "/api/http-proxy".

3. The Makefile never passed browser_http_proxy.js to the patch script
   at all.

Fix:

  - Add an uppercase `PROXY_PATH` replacement entry in
    patch-stockholm-bridge.py (keeps the lowercase one for
    app_comm.js).
  - Add a second replacement that rewrites the **use site** in
    browser_http_proxy.js to inline `(window.__stockholmBase||"") +
    "/api/http-proxy?url=" + ...`. Reading __stockholmBase at
    call-time bypasses the load-order trap; the patched
    `var PROXY_PATH = …` declaration above becomes dead code but
    stays harmless.
  - Pass `$(STOCKHOLM_DIR)/js/browser_http_proxy.js` to the patch
    script in the prepare-stockholm target so it actually gets
    rewritten.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Makefile

@@ -412,8 +412,12 @@ prepare-stockholm:
 		rm -f "$(STOCKHOLM_DIR)/js/browse.js.bak"
 	@# Patch bridge JS: replace hardcoded /api/* paths with __stockholmBase-prefixed
 	@# versions so the bridge works when Stockholm is mounted under a base path.
+	@# browser_http_proxy.js declares the proxy URL as a top-level constant;
+	@# without patching it, requests from a /stockholm/* page hit /api/http-proxy
+	@# directly and 404 because the proxy is mounted under the base path.
 	@# Also fix resolveWebviewUrl to include the base path when resolving relative URLs.
 	@python3 scripts/patch-stockholm-bridge.py \
+		"$(STOCKHOLM_DIR)/js/browser_http_proxy.js" \
 		"$(STOCKHOLM_DIR)/js/browser_native_bridge.js" \
 		"$(STOCKHOLM_DIR)/js/app_comm.js" \
 		"$(STOCKHOLM_DIR)/setup/js/app_comm.js"

scripts/patch-stockholm-bridge.py

@@ -21,6 +21,26 @@ REPLACEMENTS = [
         'var proxyPath = "/api/http-proxy";',
         'var proxyPath = (window.__stockholmBase||"") + "/api/http-proxy";',
     ),
+    (
+        # The standalone /api/http-proxy declaration in browser_http_proxy.js
+        # uses an UPPERCASE constant name. Same shape as above, different
+        # identifier — keep both replacements; the lowercase one applies to
+        # app_comm.js, the uppercase one to browser_http_proxy.js.
+        'var PROXY_PATH = "/api/http-proxy";',
+        'var PROXY_PATH = (window.__stockholmBase||"") + "/api/http-proxy";',
+    ),
+    (
+        # browser_http_proxy.js's IIFE evaluates PROXY_PATH at script-load
+        # time, but the injected bootstrap that defines window.__stockholmBase
+        # is placed just before </head> — i.e. after the <script src=…> tags
+        # for the bridge files. So PROXY_PATH would always fall back to the
+        # unprefixed "/api/http-proxy", failing under STOCKHOLM_BASE_PATH.
+        # Inline a lazy expression at the use site so it reads __stockholmBase
+        # at call time, when bootstrap has finished. The var declaration above
+        # remains patched but becomes dead code.
+        'return PROXY_PATH + "?url=" + encodeURIComponent(target.href);',
+        'return (window.__stockholmBase||"") + "/api/http-proxy?url=" + encodeURIComponent(target.href);',
+    ),
     (
         'return new URL(url, window.location.origin + "/").href;',
         'return new URL(url, window.location.origin + (window.__stockholmBase || "") + "/").href;',