I think at this point I’m proxying correctly. @acburdine was kind enough to point me at the PR showing how my nginx config needed to change, here: Added activitypub path to nginx by rmgpinto · Pull Request #1963 · TryGhost/Ghost-CLI · GitHub
(My previous attempt was not quite the same, and apparently wrong.)
I’m now getting 401, and the server is saying “No account found” on all activity-pub related requests. So… pretty sure I’ve got the proxy bit right, but something else wrong. Somewhere.