Feature: Support subpath deployment for Go web UI

Add optional YAMA_WEB_BASE_PATH to mount the whole web UI (index, manifest,
static assets, /health, /api/devices, /ws) under a URL prefix such as
/remoter behind a reverse proxy. index.html now uses a __BASE_PATH__
placeholder substituted at serve time, the PWA manifest start_url is rooted
at the base path, and a mount wrapper redirects the bare prefix to prefix/
and strips it before routing. Include nginx, systemd, and env-file deployment
examples for the subpath setup.

The shared placeholder is also handled by the MFC server, which serves from
the domain root and strips __BASE_PATH__ (to "") so its web remote desktop
URLs stay rooted.

Co-Authored-By: deepseek-v4-pro

server/go/deploy/yama.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=YAMA Remote Administration Server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=yama
+Group=yama
+WorkingDirectory=/opt/yama
+
+# 密钥 / 部署参数集中放这里（权限 600）。前面的 "-" 表示文件不存在也不报错。
+EnvironmentFile=-/etc/yama/server.env
+
+# 6543 = 客户端(agent)回连端口；8080 = 网页端 HTTP(由 nginx 反向代理)
+# arm64 机器请把二进制名换成 server_linux_arm64
+ExecStart=/opt/yama/server_linux_amd64 -port 6543 -http-port 8080 -no-console
+
+Restart=on-failure
+RestartSec=5
+
+# --- 安全加固（可选，不需要可删掉整段） ---
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+# 若服务需要写 /opt/yama 之外的目录，再放开这一行：
+# ReadWritePaths=/opt/yama/data
+
+# 日志交给 journald
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=yama
+
+[Install]
+WantedBy=multi-user.target