[SandObserver]

Summary

• Add serviceBase: the address item paths go under. A typed Link URL is trusted as reachable, including single-label host names, but only a bare address takes item paths.
• serviceLink opens a Link URL that has its own path, query or fragment as typed, instead of appending the item path to it.
• Pass serviceBase to widget data functions in place of browserLink, and use it for the Plex machine-id lookup.
• Update data test stubs and add link tests for page URLs and typed single-label hosts.

Testing
All green, e2e included. Added 4 tests.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.