fix: route stats API through path-based proxy on mainnet

- Add /stats-api/ handler in Caddy mainnet config (strips prefix, CORS)
- Update STATS_API_HOST from stats.doscan.io to doscan.io/stats-api
  (stats.doscan.io blocked by Cloudflare WAF 403)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: JOY

docker-compose/Caddyfile-mainnet

@@ -26,6 +26,15 @@ doscan.io, www.doscan.io {
         reverse_proxy backend:4000
     }
 
+    # Stats API (path-based, avoids Cloudflare subdomain issues)
+    handle /stats-api/* {
+        uri strip_prefix /stats-api
+        header Access-Control-Allow-Origin "https://doscan.io"
+        header Access-Control-Allow-Methods "GET, OPTIONS"
+        header Access-Control-Allow-Headers "Content-Type"
+        reverse_proxy stats:8050
+    }
+
     # Visualizer API (path-based)
     handle /visualize/* {
         reverse_proxy visualizer:8050

docker-compose/envs/common-frontend.env

@@ -197,7 +197,7 @@ NEXT_PUBLIC_HAS_USER_OPS=true
 # =============================================================================
 # FEATURE: STATS SERVICE
 # =============================================================================
-NEXT_PUBLIC_STATS_API_HOST=https://stats.doscan.io
+NEXT_PUBLIC_STATS_API_HOST=https://doscan.io/stats-api
 
 # =============================================================================
 # FEATURE: VISUALIZE API