20260726 修复rpki-explorer体验问题32项(#130)：RocksDB max_open_files+compose ulimits、objects列表流式早停+scope前置(每页2.85s->10ms级)、未知/过期run统一404、runs倒序、导出文件名Content-Disposition、路径段percent_decode、nginx /api/v1代理与400回SPA；前端serialNumber schema、30s请求超时、reason筛选、组合VRP查询、导出反馈与repo/PP入口、键盘可达、cursor进URL、分页/对比度/skip-link等体验项

deploy/rpki-explorer/docker-compose.yml

@@ -15,6 +15,12 @@ services:
         GIT_REV: ${GIT_REV:-unknown}
     container_name: rpki-explorer
     restart: unless-stopped
+    # RocksDB keeps table files open across 13 column families; the default
+    # 1024 nofile limit is too tight under concurrent reads.
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     ports:
       # Loopback only: access via SSH port forwarding, e.g.
       #   ssh -L 9517:127.0.0.1:9517 root@<host>

deploy/rpki-explorer/nginx.conf

@@ -8,6 +8,27 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Keep API/proxy redirects relative so port-forwarded access (ssh -L) is
+    # not bounced to an unreachable absolute URL.
+    absolute_redirect off;
+    port_in_redirect off;
+
+    # Hand-typed API URLs that fail to parse (e.g. raw % in a path segment)
+    # should land on the SPA instead of nginx's default 400 page.
+    error_page 400 /index.html;
+
+    # `/api/v1` without trailing slash must reach the service info endpoint
+    # too, not the SPA fallback.
+    location = /api/v1 {
+        proxy_pass http://127.0.0.1:9557;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
     # query service has no CORS headers and no authentication: the API must be
     # served same-origin with the UI.
     location /api/v1/ {