fix: preserve API_EXTERNAL_URL path when building confirmation links

[tsushanth]

Fixes #2518

When API_EXTERNAL_URL includes a path prefix (e.g. http://127.0.0.1:54321/auth/v1), Go's url.ResolveReference implements RFC 3986 §5.2 and replaces the entire base path with the reference path. Every confirmation and magic-link URL built in templatemailer.go uses externalURL.ResolveReference(path), so the /auth/v1 prefix is silently dropped and the link 404s.

The fix introduces resolveWithBasePath, a thin wrapper that prepends the base URL's path to the reference path rather than replacing it, then replaces all six call sites. The behavior is unchanged when API_EXTERNAL_URL has no path (the common case), because strings.TrimRight("", "/") is "".

Affected call sites: InviteMail, ConfirmationMail, EmailChangeMail, RecoveryMail, MagicLinkMail, GetEmailActionLink.

The existing URL test fixture is updated to reflect the correct (non-buggy) expectation, and a new case covering the Supabase CLI default (/auth/v1 base path) is added.