fix: use qdreader sign gateway path

tests/qdreader_plugin.test.mjs

@@ -95,7 +95,7 @@ test('manual sign and cron sign both call sign gateway then qidian checkin', ()
   const store = { qdreader_cookie_json: JSON.stringify({ '12345': cookie }) };
   const manual = runPlugin({ content: '启点签到', store: { ...store } });
   assert.equal(manual.calls.length, 2);
-  assert.match(manual.calls[0].url, /api\.120399\.xyz\/sign$/);
+  assert.match(manual.calls[0].url, /api\.120399\.xyz\/qdreader\/sign$/);
   assert.match(manual.calls[1].url, /h5\.if\.qidian\.com\/argus\/api\/v3\/checkin\/checkin$/);
   assert.match(manual.replies[0], /✅ 12\*\*\*45/);
   assert.match(manual.replies[0], /记录时间：/);
@@ -137,6 +137,23 @@ test('reads legacy otto bucket but writes new hermes_qidian bucket', () => {
   assert.equal(JSON.parse(r.bucketStore['hermes_qidian.qdreader_remark_json'])['12345'], '主号');
 });
 
+test('legacy default sign api base falls back to qdreader path when root /sign is empty', () => {
+  const store = { qdreader_cookie_json: JSON.stringify({ '12345': cookie }), qdreader_sign_api: 'https://api.120399.xyz' };
+  const r = runPlugin({
+    content: '启点签到',
+    store,
+    requests: [
+      { statusCode: 404, body: '' },
+      { body: { code: 200, data: { 'QD-Sign': 'sig2' } } },
+      { statusCode: 200, body: { code: 0, msg: '签到成功' } },
+    ],
+  });
+  assert.equal(r.calls.length, 3);
+  assert.match(r.calls[0].url, /api\.120399\.xyz\/sign$/);
+  assert.match(r.calls[1].url, /api\.120399\.xyz\/qdreader\/sign$/);
+  assert.match(r.replies[0], /✅ 12\*\*\*45/);
+});
+
 test('qidian request retries transient request errors', () => {
   const store = { qdreader_cookie_json: JSON.stringify({ '12345': cookie }), qdreader_retry_count: '2' };
   const r = runPlugin({