fix: build CID attachment URLs against the API route and base path

replaceCidReferences rewrote cid: references to /email/:id/attachment/:file,
which matches no route: attachments are served from the API server, mounted
at ${basePath}/api. When MailDev sits under a subpath the prefix was missing
as well, which is the setup described in #439.

Emit ${basePath}/api/email/:id/attachment/:file, root-relative by default, and
thread the API server's basePath through getEmailHtml. baseUrl still prefixes
//host for a caller that passes it.

On the current code this does not change what the web UI shows for a typical
message: mailparser already inlines related parts as data: URIs, and a cid:
that survives parsing is one that matches no attachment. replaceCidReferences
is exported from @maildev/smtp, though, so the URL it builds should resolve.

Refs #439

packages/smtp/src/__tests__/sanitize.test.ts

@@ -73,7 +73,7 @@ describe('replaceCidReferences', () => {
 
     const result = replaceCidReferences(html, 'email1', attachments)
 
-    expect(result).toContain('/email/email1/attachment/abc.png')
+    expect(result).toContain('/api/email/email1/attachment/abc.png')
     expect(result).not.toContain('cid:')
   })
 
@@ -85,7 +85,7 @@ describe('replaceCidReferences', () => {
 
     const result = replaceCidReferences(html, 'email1', attachments)
 
-    expect(result).toContain('/email/email1/attachment/abc.png')
+    expect(result).toContain('/api/email/email1/attachment/abc.png')
   })
 
   it('should include baseUrl when provided', () => {
@@ -96,7 +96,30 @@ describe('replaceCidReferences', () => {
 
     const result = replaceCidReferences(html, 'email1', attachments, 'example.com')
 
-    expect(result).toContain('//example.com/email/email1/attachment/abc.png')
+    expect(result).toContain('//example.com/api/email/email1/attachment/abc.png')
+  })
+
+  it('should include basePath when MailDev is mounted under a subpath', () => {
+    const html = '<img src="cid:image123">'
+    const attachments = [
+      { contentId: 'image123', generatedFileName: 'abc.png' },
+    ]
+
+    const result = replaceCidReferences(html, 'email1', attachments, undefined, '/mail')
+
+    expect(result).toContain('src="/mail/api/email/email1/attachment/abc.png"')
+  })
+
+  it('should normalize a basePath given with or without slashes', () => {
+    const html = '<img src="cid:image123">'
+    const attachments = [
+      { contentId: 'image123', generatedFileName: 'abc.png' },
+    ]
+
+    for (const basePath of ['mail', '/mail', '/mail/']) {
+      const result = replaceCidReferences(html, 'email1', attachments, undefined, basePath)
+      expect(result).toContain('src="/mail/api/email/email1/attachment/abc.png"')
+    }
   })
 
   it('should replace multiple cid references', () => {