fix: serve an origin-relative base href

[frdm666]

Problem

Dekaf renders a blank page when opened on a host other than the one in
DEKAF_PUBLIC_BASE_URL — e.g., a container published as 127.0.0.1:8091 but
reached via localhost:8091.

The page carried an absolute <base href> built from that setting, and the
browser resolves everything relative against it. Two failure modes, depending on
whether that host is reachable from the client:

• Not reachable — <script src="ui/static/dist/entrypoint.js"> resolves to
  the user's own machine: Uncaught ReferenceError: pulsarUiEntrypoint is not defined.
• Reachable but a different origin (the case in Uncaught DOMException: The operation is insecure. #349) — assets load, then
  react-router calls history.pushState() with a foreign-origin URL, which
  browsers forbid: Uncaught DOMException: The operation is insecure.

Either way, the app dies while mounting, with no hint about what to fix.

What changed

• Serve only the path part of DEKAF_PUBLIC_BASE_URL as the base href (/,
  or /dekaf/ behind a reverse-proxy prefix). A path always resolves against the
  origin the page came from, so no mismatch is possible.
• Build the gRPC-web and pulsar-auth URLs from the current origin too (new
  basePath field on the UI config) — otherwise the app would render but fail
  every request with CORS.

Reverse-proxy prefixes still work: DEKAF_PUBLIC_BASE_URL=http://localhost:8090/demo
serves <base href="/demo/" />.

Test plan

Added NAV-16 (e2e/src/test/scala/routes/BasePathSpec.scala): opens Dekaf on
127.0.0.1 while the server is configured for localhost, asserts the UI renders
and that no SecurityError is raised. It navigates to / on purpose — the root
redirect is what triggers the failing history call; going straight to /overview
passes even with the bug.

Verified it fails without the fix. Also re-ran OverviewSmokeSpec,
NavigationSpec, CredentialsSpec, HealthCheckSpec — 10 tests, all green.

Fixes #349