feat(web_ui): per-path reverse-proxy via HIVE_EXTRA_WEB_PROXIES

docs/web-ui/agent.md

@@ -402,6 +402,16 @@ shaped).
   Transparent to any RFB variant. VNC port comes from the
   `HIVE_GUI_VNC_PORT` env var (a fixed port set on the harness
   service when `hyperhive.gui.enable`; see `weston-vnc.nix`).
+- `GET|POST /extra/<name>/…` — **extra web proxies** declared via
+  `hyperhive.extraWebProxies` in `agent.nix` (serialised to the
+  `HIVE_EXTRA_WEB_PROXIES` env var as a JSON object
+  `{"<name>": "<upstream_url>"}`). Each entry mounts a transparent
+  reverse-proxy at `/extra/<name>/` that forwards every request (method,
+  headers, body) to the configured upstream, strips hop-by-hop headers
+  on both sides, and buffers the full response body (MVP — SSE
+  connections will appear as one large response rather than streaming).
+  The `/extra/` namespace ensures user-declared proxies can never
+  conflict with native agent endpoints. Implemented in `web_ui/proxy.rs`.
 
 Bus events (new vocabulary on `/events/stream`):