Support path prefixes in Agent.to_web()

[dsfaccini]

This pull request was posted by Codex Desktop using gpt-5.6-sol on behalf of David.

• Closes Support mounting Agent.to_web() below a URL path prefix #7611

Derive the chat UI's public navigation and API directories from each request's ASGI root_path, with independent base_path and api_path overrides for proxy topologies that cannot be represented by root_path.

The raw HTML remains cached unchanged. Each response receives a script-safe window.PYDANTIC_AI_CHAT_CONFIG bootstrap before the UI module executes. The path validation keeps generated requests same-origin and avoids browser URL-normalization escapes.

Release dependency

This draft depends on pydantic/ai-chat-ui#47 being merged and released. CHAT_UI_VERSION is intentionally unchanged because no released UI version consumes the runtime configuration yet. Before this PR can leave draft, it must be updated to the compatible released UI artifact and verified against both the default CDN and offline HTML.

Verification

• Web UI tests pass.
• Changed documentation examples pass.
• Formatting, lint, type checking, and cassette checks pass.

Checklist

• Any AI generated code has been reviewed line-by-line by the human PR author, who stands by it.
• No breaking changes in accordance with the version policy.
• PR title is fit for the release changelog.

[dsfaccini]

This comment was posted by Codex Desktop using gpt-5.6-sol on behalf of David.

Closing as an accidentally created duplicate of #7612. Its distinct validation and HTML-injection findings are being reviewed by the canonical task before that PR proceeds.

[github-actions]

SECURITY: PASS

The PR does not touch the UI message-history trust boundary (dump_messages / load_messages / sanitize_messages / FileUrl / SSRF surface). The new surface is purely the chat web UI HTML bootstrap, and the introdued code is well-defended:

• _normalize_public_path (default-deny) rejects protocol-relative URLs (//), ../. segments (after URL-decoding, so %2e%2e is caught), control chars (\t\n\r), backslashes, and query/fragment. The PR keeps the documented "no cross-origin" policy (PR #7611 explicitly scopes cross-origin out).
• base_path/api_path are server-side configuration only (creation time), with secure defaults (None → derive from root_path).
• The root_path from request.scope is quote(safe='/')d before validation, normalizing any server-set value before the boundary check.
• HTML injection of the PYDANTIC_AI_CHAT_CONFIG bootstrap is escaped at the JSON level (ensure_ascii=True) and additionally at the script-token boundary (&/</> → \u0026/\u003c/\u003e), preventing </script> breakouts. The test_chat_app_bootstrap_serialization_is_script_safe regression covers this.
• The existing HostValidationMiddleware still wraps the app unchanged.

No HIGH or CRITICAL findings.