Fix app-to-app API calls being blocked by app isolation in 0.28.2-beta.

call_app_api() now switches the isolation root to the target app's own folder for both the module load and the call itself, so a callee can open its own files instead of being judged by the caller's confinement, while each side still reaches nothing outside its own folder. The Apps Hub App APIs toggle remains the sole gate on whether a call is allowed, and toggling it now drops the cached module so the change takes effect immediately. This restores the Tasks and Shopping List reward-to-Budget integrations, broken since app isolation landed in 0.28.0-beta.