Support subpath IIS deployment as a second install method

The app can run as an IIS Application under an existing site
(e.g. https://host/ops/) instead of its own site + port:

- frontend: vite base via VITE_BASE_PATH; router history, axios
  baseURL, and root-absolute asset/route paths resolve through
  utils/basePath.js withBase()
- backend: MOUNT_PATH (env or .env) wraps the app in a WSGI
  middleware that shifts the prefix into SCRIPT_NAME, so one knob
  serves API + SPA under the mount
- docs: INSTALL-WINDOWS-IIS.md section 7b runbook + troubleshooting
  rows; DEPLOY-WINDOWS-IIS.md pointer; commented examples in
  deploy/windows/web.config and .env.example

Root deployment unchanged (MOUNT_PATH unset, base '/'). Also folds
two stray root-absolute callers into the shared plumbing
(MachineForm relationship-types fetch, reports CSV window.open).

frontend/src/api/index.js

@@ -1,7 +1,10 @@
 import axios from 'axios'
+import { withBase } from './../utils/basePath'
 
+// BASE_URL ends in '/', so this is '/api' at root or '/ops/api' under a subpath
+// mount. Keeps the SPA, its API, and IIS all on the same mount path.
 const api = axios.create({
-  baseURL: '/api',
+  baseURL: import.meta.env.BASE_URL + 'api',
   headers: {
     'Content-Type': 'application/json'
   }
@@ -31,10 +34,11 @@ api.interceptors.response.use(
       // Only redirect if user was previously logged in (session expired).
       // Preserve the destination so login returns the user to this page.
       if (hadToken) {
+        const loginPath = withBase('/login')
         const here = window.location.pathname + window.location.search
-        const target = here && here !== '/login'
-          ? '/login?redirect=' + encodeURIComponent(here)
-          : '/login'
+        const target = here && here !== loginPath
+          ? loginPath + '?redirect=' + encodeURIComponent(here)
+          : loginPath
         window.location.href = target
       }
     }