fix: build CID attachment URLs against the API route and base path

replaceCidReferences rewrote cid: references to /email/:id/attachment/:file,
which matches no route: attachments are served from the API server, mounted
at ${basePath}/api. When MailDev sits under a subpath the prefix was missing
as well, which is the setup described in #439.

Emit ${basePath}/api/email/:id/attachment/:file, root-relative by default, and
thread the API server's basePath through getEmailHtml. baseUrl still prefixes
//host for a caller that passes it.

On the current code this does not change what the web UI shows for a typical
message: mailparser already inlines related parts as data: URIs, and a cid:
that survives parsing is one that matches no attachment. replaceCidReferences
is exported from @maildev/smtp, though, so the URL it builds should resolve.

Refs #439

packages/api/src/server.ts

@@ -457,11 +457,11 @@ export class APIServer extends EventEmitter {
       `${apiPath}/email/:id/html`,
       async (request, reply) => {
         const { id } = request.params
-        const baseUrl = request.headers.host ?? ''
 
         try {
           if (this.smtp) {
-            const html = await this.smtp.getEmailHtml(id, { baseUrl })
+            // No host: the HTML is rendered for a browser already on this origin
+            const html = await this.smtp.getEmailHtml(id, { basePath })
             if (!html) {
               return reply.status(404).send({ error: 'Email has no HTML content' })
             }