build: wire portal-frontend into proxy and docker-compose

Adds portal-frontend as a new service (no published port, only
reachable via the proxy, same as new-frontend) and two nginx location
blocks for /portal - a bare-path redirect plus the prefix-stripping
proxy_pass. The existing /, /legacy, and /api/ blocks are unchanged.

Verified end to end: /portal/, a deep link, and / all return 200
through the single published proxy port, and /api/worklist still
returns the full 17-item worklist.

proxy/nginx.conf

@@ -26,6 +26,21 @@ http {
       proxy_set_header Host $host;
     }
 
+    # Session 2's Angular portal, kept alongside the Session 1 placeholder
+    # at "/" for side-by-side comparison. The trailing slash on both the
+    # location and proxy_pass strips the /portal prefix (same shape as the
+    # "/" -> new-frontend block below); the bare-path redirect below only
+    # exists to catch "/portal" (no trailing slash), which wouldn't match
+    # "location /portal/" and would otherwise silently fall through to "/".
+    location = /portal {
+      return 301 /portal/;
+    }
+
+    location /portal/ {
+      proxy_pass http://portal-frontend:80/;
+      proxy_set_header Host $host;
+    }
+
     location / {
       proxy_pass http://new-frontend:80/;
       proxy_set_header Host $host;