Build every ApiClient request URL in one place (closes #18)

getJSON built its URL with new URL and then overwrote the host and
path, which dropped a base path in a self-hosted apiOrigin; postJSON,
putJSON and the file and thumbnail download URLs joined strings. All of
them now go through one function next to ApiClient that accepts a path
with or without a leading slash and an origin with or without a
trailing slash or base path, and percent-encodes query parameters. A
path containing "?" or "#" is rejected.

Model: opus-5-5

TODO.md

@@ -18,6 +18,11 @@ Tag v1.0.0.
 
 # Completed Steps
 
+- 2026-09-23: Every `ApiClient` request URL is now built by one function next to
+  the class (issue 18), so a self-hosted `apiOrigin` with a base path keeps it
+  on every request, a path works with or without a leading slash, and query
+  parameters are percent-encoded. A path containing `?` or `#` is rejected with
+  an error instead of being silently cut.
 - 2026-09-23: Hardened the JPEG EXIF scan behind `backup-metadata --exif` (issue
   11). Every segment length is checked against the remaining bytes and lengths
   under 2 stop the scan, so a truncated or corrupt original can neither throw