docs: add backup notes and refresh checklist

deploy/REVERSE_PROXY.md

@@ -75,3 +75,23 @@ server {
 - In production the frontend uses relative URLs, so it works correctly behind the same origin without hardcoded API hosts.
 - In local frontend development, Vite proxies `/api`, `/rest`, and `/health` to `http://127.0.0.1:5050`.
 - If you later enable HTTPS on an external reverse proxy, clients should still connect to one public base URL only.
+- Web UI and Subsonic clients should always use the same public base URL, only differing by path usage.
+
+## Recommended Public Contract
+
+Public examples:
+
+- browser: `https://music.example.com/`
+- Subsonic clients: `https://music.example.com`
+
+Internal upstream:
+
+- `http://127.0.0.1:5050`
+
+Do not publish separate public ports for:
+
+- web UI
+- `/api/*`
+- `/rest/*`
+- `/api/stream/*`
+- `/api/cover-art/*`