fix(split-audit): correct CMS API client target, render mode, asset URL, and stale config

CMS pages were calling api/cms/track on https://localhost:5001 (the public host)
because the DeepDrft.API named client was base-addressed there; controllers live
on the Manager. Re-pointed to baseUrl. /cms page declared InteractiveAuto in a
Server-only host. App.razor link for MudBlazorThemeManager.css had _ outside the
@Assets[] expression. Public connections example carried a leftover Auth string.

DeepDrftCms/Pages/Cms/Index.razor

@@ -1,5 +1,5 @@
 @page "/cms"
-@rendermode InteractiveAuto
+@rendermode InteractiveServer
 @using AuthBlocksWeb.HierarchicalAuthorize
 @attribute [HierarchicalRoleAuthorize("Admin")]