fix(rest): build signin URLs from restUrl under plain permalinks

credits.js hardcoded siteUrl + /wp-json/aksrt/v1 which 404s when WP uses
plain permalinks (?rest_route=...). Prefer aksrtData.restUrl/apiUrl and
harden header-userbox path join for the same case.

assets/js/header-userbox.js

@@ -6,10 +6,23 @@
 (function () {
   'use strict';
 
-  function restBase() {
-    if (window.aksrtData && window.aksrtData.restUrl) return window.aksrtData.restUrl.replace(/\/?$/, '/');
-    if (window.aksrtData && window.aksrtData.siteUrl) return String(window.aksrtData.siteUrl).replace(/\/?$/, '/') + 'wp-json/';
-    return '/wp-json/';
+  function restUrl(path) {
+    path = String(path || '').replace(/^\//, '');
+    var base = '';
+    if (window.aksrtData && window.aksrtData.restUrl) base = String(window.aksrtData.restUrl);
+    else if (window.aksrtData && window.aksrtData.apiUrl) base = String(window.aksrtData.apiUrl);
+    else if (window.aksrtData && window.aksrtData.siteUrl) base = String(window.aksrtData.siteUrl).replace(/\/?$/, '/') + 'wp-json/aksrt/v1';
+    else base = '/wp-json/aksrt/v1';
+    base = base.replace(/\/?$/, '');
+    // Plain permalinks: ...?rest_route=/aksrt/v1  → append /path to rest_route value
+    if (base.indexOf('rest_route=') !== -1) {
+      if (base.charAt(base.length - 1) === '/') {
+        return base + path;
+      }
+      // rest_route=/aksrt/v1 + /signin
+      return base + '/' + path;
+    }
+    return base + '/' + path;
   }
 
   function restNonce() {
@@ -80,7 +93,7 @@
       if (!btn || btn.disabled) return;
       e.preventDefault();
       btn.disabled = true;
-      fetch(restBase() + 'signin', {
+      fetch(restUrl('signin'), {
         method: 'POST',
         credentials: 'same-origin',
         headers: {