Dedicated nginx server block on :8543 (not proxied under the dashboard's 80/443) because the dashboard sets Permissions-Policy: geolocation=() server-wide, which would silently break Regress's core claim/link mechanic. Also documents a found-but-not-fixed gap: the dashboard's app iframe has no allow="geolocation", so the in-dashboard launch path won't get location access either until that shared component is patched.