Route /api/ui through nginx to bypass Cloudflare Access; bump restartedAt

The /api/ui path is now routed to the fornax-ui nginx pod (which proxies
internally to the coordinator) rather than directly to the coordinator.
This fixes the browser fetch being blocked by Cloudflare Access.

Both coordinator and UI deployments get a restartedAt bump to pull the
new images after CI builds.

servers/legion/k8s/fornax/coordinator/deployment.yaml

@@ -13,7 +13,7 @@ spec:
   template:
     metadata:
       annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-04-14T19:30:00Z"
+        kubectl.kubernetes.io/restartedAt: "2026-04-14T20:15:00Z"
       labels:
         app: fornax-coordinator
     spec:

servers/legion/k8s/fornax/coordinator/ingress.yaml

@@ -16,7 +16,16 @@ spec:
     - host: fornax.neuralplatform.ai
       http:
         paths:
-          # API and health routes go to the Express backend
+          # /api/ui proxied through the UI nginx pod (which forwards internally,
+          # bypassing Cloudflare Access for browser fetch calls)
+          - path: /api/ui
+            pathType: Prefix
+            backend:
+              service:
+                name: fornax-ui
+                port:
+                  number: 80
+          # All other API and health routes go directly to the Express backend
           - path: /api
             pathType: Prefix
             backend:

servers/legion/k8s/fornax/ui/deployment.yaml

@@ -13,7 +13,7 @@ spec:
   template:
     metadata:
       annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-04-14T19:30:00Z"
+        kubectl.kubernetes.io/restartedAt: "2026-04-14T20:15:00Z"
       labels:
         app: fornax-ui
     spec: