fix(split-audit): correct CMS API client target, render mode, asset URL, and stale config

CMS pages were calling api/cms/track on https://localhost:5001 (the public host)
because the DeepDrft.API named client was base-addressed there; controllers live
on the Manager. Re-pointed to baseUrl. /cms page declared InteractiveAuto in a
Server-only host. App.razor link for MudBlazorThemeManager.css had _ outside the
@Assets[] expression. Public connections example carried a leftover Auth string.

DeepDrftCms/Pages/Cms/Index.razor

@@ -1,5 +1,5 @@
 @page "/cms"
-@rendermode InteractiveAuto
+@rendermode InteractiveServer
 @using AuthBlocksWeb.HierarchicalAuthorize
 @attribute [HierarchicalRoleAuthorize("Admin")]
 

DeepDrftManager/Program.cs

@@ -81,12 +81,13 @@ builder.Services.AddAuthBlocks(options =>
 var baseUrl = GetKestrelUrl(builder);
 AuthBlocksWeb.Startup.ConfigureAuthServices(builder.Services, baseUrl);
 
-// Named HttpClient used by CMS pages for auth API calls (AuthBlocks surface on this host).
-var apiHostUrl = builder.Configuration["ApiUrls:ApiHost"]
-    ?? throw new InvalidOperationException("ApiUrls:ApiHost is required");
+// Named HttpClient used by CMS pages for in-process CMS endpoints (CmsUploadController,
+// CmsEditController, CmsDeleteController) and the AuthBlocks surface — both live on this host.
+// Base-addressed to the Manager's own Kestrel URL so callers using relative paths
+// (e.g. "api/cms/track") hit our own controllers, not the public host.
 builder.Services.AddHttpClient("DeepDrft.API", client =>
 {
-    client.BaseAddress = new Uri(apiHostUrl);
+    client.BaseAddress = new Uri(baseUrl);
 });
 
 // Named HttpClient for unauthenticated Content API calls (e.g. CmsUploadController proxying WAV

DeepDrftManager/appsettings.json

@@ -7,7 +7,6 @@
   },
   "AllowedHosts": "*",
   "ApiUrls": {
-    "ApiHost": "https://localhost:5001",
     "ContentApi": "https://content.deepdrft.com"
   },
   "ForwardedHeaders": {

DeepDrftPublic/Components/App.razor

@@ -8,7 +8,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <base href="/" />
     <DeepDrftFontLinks />
-    <link href="_@Assets["content/MudBlazor.ThemeManager/MudBlazorThemeManager.css"]" rel="stylesheet" />
+    <link href="@Assets["_content/MudBlazor.ThemeManager/MudBlazorThemeManager.css"]" rel="stylesheet" />
     <link href=@Assets["_content/MudBlazor/MudBlazor.min.css"] rel="stylesheet" />
     <link rel="stylesheet" href="@Assets["DeepDrftPublic.styles.css"]"/>
     <link rel="stylesheet" href="@Assets["_content/DeepDrftShared.Client/styles/deepdrft-tokens.css"]" />

DeepDrftPublic/connections.example.json

@@ -1,6 +1,5 @@
 {
   "ConnectionStrings": {
-    "DefaultConnection": "Host=localhost;Port=5433;Database=postgres;Username=postgres;Password=your-password-here",
-    "Auth": "Host=localhost;Port=5433;Database=postgres;Username=postgres;Password=your-password-here"
+    "DefaultConnection": "Host=localhost;Port=5433;Database=postgres;Username=postgres;Password=your-password-here"
   }
 }