match the appSubUrl shape Gitea actually emits

The regex expected JSON — "appSubUrl":"…" — and Gitea emits a JavaScript object
literal: unquoted key, single quotes, `appSubUrl: ''`. So the single
highest-value rewrite in this file silently did nothing on every real page,
while every attribute around it rewrote perfectly.

The test used the shape I guessed rather than the shape Gitea produces, which
is why it passed. Now covers both, with the real form taken verbatim from a
live response, and asserts the quote style survives — swapping it would stop
the literal parsing.

sidecar/rewrite.ts

@@ -74,7 +74,14 @@ export function rewriteAttributes(html: string, base: string): string {
  * Matched narrowly on the key so a repository whose CONTENT contains the string is untouched.
  */
 export function rewriteAppSubUrl(html: string, base: string): string {
-  return html.replace(/"appSubUrl"\s*:\s*"[^"]*"/g, `"appSubUrl":"${base}"`);
+  // Both shapes, because Gitea emits the SECOND one and this originally only matched the first:
+  //   "appSubUrl":"…"   JSON, which is what an API response looks like
+  //   appSubUrl: '…'    a JavaScript object literal, unquoted key and single quotes — the real page
+  // Guessing the shape is why this silently did nothing while every attribute around it was rewritten
+  // correctly. The quote style is captured and reused so the emitted literal stays valid either way.
+  return html.replace(/(["']?appSubUrl["']?\s*:\s*)(["'])[^"']*\2/g, (_m, head: string, quote: string) =>
+    `${head}${quote}${base}${quote}`,
+  );
 }
 
 /**