Fix: honour basePath in plugin sandbox, http.post proxy, and branding

Upstream 1.7.2 prefixes most hand-written URLs with basePath via apiFetch /
withBasePath, but four subpath-relevant spots were missed:

- host-bridge: the sandbox iframe src was a bare "/plugin-sandbox" -> 404
  under NEXT_PUBLIC_BASE_PATH, breaking all plugins. Wrap in withBasePath.
- host-api doHttpPost: the same-origin /api/* plugin proxy used raw fetch on
  url.pathname -> 404 under a subpath. Route it through apiFetch.
- admin branding preview <img>: unprefixed src -> broken thumbnail.
- (sandbox) layout: drop the Geist font + globals.css imports. The sandbox
  runs with an opaque origin, so those assets are CORS-blocked; the plugin
  bundle and all host API calls travel over the postMessage bridge, so no
  same-origin asset fetch happens there.

lib/plugin-sandbox/host-api.ts

@@ -140,7 +140,7 @@ async function doHttpPost(plugin: InstalledPlugin, path: string, body: unknown):
     headers['Authorization'] = client.getAuthHeader();
     headers['X-JMAP-Username'] = client.getUsername();
   }
-  const res = await fetch(url.pathname + url.search, {
+  const res = await apiFetch(url.pathname + url.search, {
     method: 'POST',
     headers,
     body: JSON.stringify(body),

lib/plugin-sandbox/host-bridge.ts

@@ -10,6 +10,7 @@
 import type { InstalledPlugin, SlotName } from '../plugin-types';
 import { dispatchApiCall } from './host-api';
 import { SANDBOX_PATH } from './protocol';
+import { withBasePath } from '../browser-navigation';
 import type {
   SandboxToHost, HostToSandbox, InitMsg, InitPayload,
 } from './protocol';
@@ -143,7 +144,10 @@ export class SandboxInstance {
       this.iframe.style.width = '100%';
       this.iframe.style.height = '0px';
     }
-    this.iframe.src = SANDBOX_PATH;
+    // Prefix with the mount path so the sandbox route resolves under a
+    // subpath deployment (NEXT_PUBLIC_BASE_PATH=/webmail). A bare
+    // "/plugin-sandbox" would hit the origin root and 404, breaking plugins.
+    this.iframe.src = withBasePath(SANDBOX_PATH);
 
     this.listener = (ev) => this.onMessage(ev);
     window.addEventListener('message', this.listener);