fix: serve MindSpace public assets as same-origin relative URLs

Rewrite absolute tkmind asset download links to /api/... at delivery time
and strip base tags that violate public page CSP, so images load on any host.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -59,7 +59,7 @@ import {
   resolvePublicRequestOrigin,
 } from './mindspace-public-page-context.mjs';
 import {
-  appendPublicAssetTokens,
+  preparePublicHtmlAssetDelivery,
   verifyPublicAssetToken,
 } from './mindspace-public-asset-token.mjs';
 import {
@@ -5427,7 +5427,7 @@ async function sendPublishFile(req, res, filePath) {
     res.status(404).json({ message: '文件不存在' });
     return;
   }
-  html = appendPublicAssetTokens(html, INTERNAL_AGENT_SECRET);
+  html = preparePublicHtmlAssetDelivery(html, INTERNAL_AGENT_SECRET);
   const embed = isPlazaEmbedRequest(req.query);
   if (embed) {
     html = preparePublicationHtmlForEmbed(html);