Media downloads ignore path in homeserver URL

### Steps to reproduce

I make my homeserver accessible via tailscale to all of my devices using `tailscale serve` with a path. Thus, my homeserver URL is: `https://automattic.tail3c5d.ts.net/matrix`.

Sync/event send/etc. requests are correctly sent to `https://automattic.tail3c5d.ts.net/matrix/_matrix/...`, but media downloads are not sent to the correct homeserver.

### Outcome

#### What did you expect?

I expect that media downloads go to
```
https://automattic.tail3c5d.ts.net/matrix/_matrix/media/v3/...
```
endpoints.

#### What happened instead?

When my client tries to download images, it uses the incorrect URL:
```
https://automattic.tail3c5d.ts.net/_matrix/media/v3/...
```
(notice the missing `/matrix` prefix which is a subpath configured in tailscale)

### Operating system

Linux

### Browser information

Chromium Version 130.0.6723.116 (Official Build) (64-bit)

### URL for webapp

develop.element.io

### Application version

Element version: 5d7c71210ff3-js-2210255d6ffc Crypto version: Rust SDK 0.7.2 (517d99b), Vodozemac 0.7.0

### Homeserver

Synapse

### Will you send logs?

No