fix(rest): build signin URLs from restUrl under plain permalinks

credits.js hardcoded siteUrl + /wp-json/aksrt/v1 which 404s when WP uses
plain permalinks (?rest_route=...). Prefer aksrtData.restUrl/apiUrl and
harden header-userbox path join for the same case.

assets/js/credits.js

@@ -11,17 +11,30 @@
 	'use strict';
 
 	var aksrt = window.aksrtData;
-	if (!aksrt || !aksrt.siteUrl) {
+	if (!aksrt) {
 		return;
 	}
 
-	// 协议修正：页面是 HTTPS 但 siteUrl 是 HTTP 时，强制使用 HTTPS（避免混合内容拦截）
+	// Prefer restUrl/apiUrl from wp_localize (handles plain permalinks:
-	var siteUrl = aksrt.siteUrl;
+	// /?rest_route=/aksrt/v1/...). Never hardcode /wp-json/ under siteUrl.
-	if (window.location.protocol === 'https:' && siteUrl.substring(0, 5) === 'http:') {
+	var REST = '';
-		siteUrl = 'https:' + siteUrl.substring(5);
+	if (aksrt.restUrl) {
+		REST = String(aksrt.restUrl).replace(/\/?$/, '');
+	} else if (aksrt.apiUrl) {
+		REST = String(aksrt.apiUrl).replace(/\/?$/, '');
+	} else if (aksrt.siteUrl) {
+		var siteUrl = String(aksrt.siteUrl);
+		if (window.location.protocol === 'https:' && siteUrl.substring(0, 5) === 'http:') {
+			siteUrl = 'https:' + siteUrl.substring(5);
+		}
+		REST = siteUrl.replace(/\/$/, '') + '/wp-json/aksrt/v1';
+	} else {
+		return;
+	}
+	// Force HTTPS if page is HTTPS (mixed content).
+	if (window.location.protocol === 'https:' && REST.substring(0, 5) === 'http:') {
+		REST = 'https:' + REST.substring(5);
 	}
-
-	var REST = siteUrl.replace(/\/$/, '') + '/wp-json/aksrt/v1';
 	var NONCE_HEADER = aksrt.restNonce ? { 'X-WP-Nonce': aksrt.restNonce } : (aksrt.nonce ? { 'X-WP-Nonce': aksrt.nonce } : {});
 
 	function api(path, options) {

assets/js/header-userbox.js

@@ -6,10 +6,23 @@
 (function () {
   'use strict';
 
-  function restBase() {
+  function restUrl(path) {
-    if (window.aksrtData && window.aksrtData.restUrl) return window.aksrtData.restUrl.replace(/\/?$/, '/');
+    path = String(path || '').replace(/^\//, '');
-    if (window.aksrtData && window.aksrtData.siteUrl) return String(window.aksrtData.siteUrl).replace(/\/?$/, '/') + 'wp-json/';
+    var base = '';
-    return '/wp-json/';
+    if (window.aksrtData && window.aksrtData.restUrl) base = String(window.aksrtData.restUrl);
+    else if (window.aksrtData && window.aksrtData.apiUrl) base = String(window.aksrtData.apiUrl);
+    else if (window.aksrtData && window.aksrtData.siteUrl) base = String(window.aksrtData.siteUrl).replace(/\/?$/, '/') + 'wp-json/aksrt/v1';
+    else base = '/wp-json/aksrt/v1';
+    base = base.replace(/\/?$/, '');
+    // Plain permalinks: ...?rest_route=/aksrt/v1  → append /path to rest_route value
+    if (base.indexOf('rest_route=') !== -1) {
+      if (base.charAt(base.length - 1) === '/') {
+        return base + path;
+      }
+      // rest_route=/aksrt/v1 + /signin
+      return base + '/' + path;
+    }
+    return base + '/' + path;
   }
 
   function restNonce() {
@@ -80,7 +93,7 @@
       if (!btn || btn.disabled) return;
       e.preventDefault();
       btn.disabled = true;
-      fetch(restBase() + 'signin', {
+      fetch(restUrl('signin'), {
         method: 'POST',
         credentials: 'same-origin',
         headers: {