feat: serve under a URL path prefix with --base-path - #61624

Hey! Your PR title Server base path doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

We'd like to use this to run OpenCode inside marimohub, the self-hosted marimo server. It already runs VS Code next to the notebook through an authenticated proxy at /surface-proxy/<signed-token>/<surface>/. OpenCode is currently limited to subdomain exposure because of its root-relative paths, so --base-path is the missing piece for us.

On the open questions:

• A 404 outside the prefix is fine for us. The proxy only forwards paths under the prefix, and we don't use --service.
• We don't need the service worker under a prefix.

Things we'd depend on:

• The prefix is a signed token per session, shaped like /surface-proxy/<project-id>.<session-id>.<base64url-signature>/opencode. That passes normalize as written. Please keep ., _ and - allowed in segments.
• The event stream and the terminal WebSocket under the prefix, which you mention checking behind nginx.

One question: does the app assume the browser's path matches the prefix the server sees? A proxy in front may strip an outer prefix first (for example, the hub served under /hub). The browser would then be at /hub/surface-proxy/… while OpenCode sees /surface-proxy/…. Relative asset URLs would still resolve, but I wasn't sure about the router or the cookie path.

Happy to test a build behind marimohub's proxy once #60559 lands.