docs: trim README reverse proxy example

README.md

@@ -101,53 +101,12 @@ The published production client is deployment-independent. The same package work
 
 For a root deployment, proxy `/` directly to `http://127.0.0.1:8504` without rewriting the path. For a nested deployment:
 
-1. Redirect the slashless prefix (`/ai`) to its trailing-slash form (`/ai/`). The browser uses that document URL as the application base.
-2. Strip `/ai` before forwarding requests. PI WEB continues to serve `/`, `/api/...`, and `/pi-web-plugins/...` on its localhost listener.
-3. Put authentication on the whole served `/ai/` application and preserve authentication headers/cookies when forwarding.
-4. Proxy WebSocket upgrades through the same prefix. Do not create unprotected exceptions for API or plugin paths.
+1. Redirect the slashless prefix (`/ai`) to its trailing-slash form (`/ai/`).
+2. Strip the prefix before forwarding requests to PI WEB.
+3. Apply authentication to the whole prefixed application.
+4. Proxy HTTP and WebSocket traffic through the same prefix; do not create unprotected API or plugin exceptions.
 
-For example, this Nginx configuration belongs behind working TLS certificate directives:
-
-```nginx
-# http context
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
-server {
-    listen 443 ssl;
-    server_name pi.example.com;
-
-    ssl_certificate     /etc/letsencrypt/live/pi.example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/pi.example.com/privkey.pem;
-
-    auth_basic "PI WEB";
-    auth_basic_user_file /etc/nginx/pi-web.htpasswd;
-
-    location = /ai {
-        return 308 /ai/$is_args$args;
-    }
-
-    location ^~ /ai/ {
-        # The trailing slash strips /ai/ before forwarding.
-        proxy_pass http://127.0.0.1:8504/;
-        proxy_http_version 1.1;
-
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Authorization $http_authorization;
-        proxy_set_header Cookie $http_cookie;
-
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-        proxy_read_timeout 1h;
-    }
-}
-```
-
-Use the same pattern for `/test/ai/` by changing both Nginx locations. If your proxy uses bearer tokens, SSO, or another authentication mechanism, keep that policy on the prefixed application location and continue forwarding the headers/cookies it requires; the slashless redirect serves no PI WEB content. Relative client, PWA, image, API, plugin, and WebSocket URLs then remain inside the deployment prefix; installed PWA `start_url` and scope do too.
+See the [reverse proxy installation guide](https://pi-web.dev/install#reverse-proxy-prefix) for the complete Nginx configuration, TLS and authentication guidance, and deeper prefixes such as `/test/ai/`.
 
 ## Machines and fleets