fix(quickproxy): reject Exclude entries outside their rule's URLPrefix

An Exclude entry only ever matches requests that already fall under
its rule's URLPrefix, so one written without that prefix (e.g.
"/health" on a rule for "/api") silently never triggered. Validate
that each Exclude entry itself starts with the rule's URLPrefix,
failing NewService instead of accepting a no-op config.

pkg/server/quickproxy/quickproxy_test.go

@@ -26,10 +26,16 @@ func TestNewService_Validation(t *testing.T) {
 		{"bad exclude prefix", []Rule{
 			{URLPrefix: "/", Target: "http://localhost:1", Exclude: []string{"health"}},
 		}, true},
+		{"exclude outside rule's URLPrefix", []Rule{
+			{URLPrefix: "/api", Target: "http://localhost:1", Exclude: []string{"/health"}},
+		}, true},
 		{"valid", []Rule{{URLPrefix: "/api", Target: "http://localhost:1"}}, false},
 		{"valid with exclude", []Rule{
 			{URLPrefix: "/", Target: "http://localhost:1", Exclude: []string{"/health"}},
 		}, false},
+		{"valid with nested exclude", []Rule{
+			{URLPrefix: "/api", Target: "http://localhost:1", Exclude: []string{"/api/health"}},
+		}, false},
 	}
 
 	for _, tt := range tests {