cli/api: route pinned --jurisdiction to its own cell; address review

Two fixes from PR review:

• Cursor Bugbot (correctness): when --jurisdiction was set, the CellTarget carried only Jurisdiction (no BaseURL). If the configured data origin was already a direct entire-api cell (a ".api." host) rather than an apex/BFF, auth kept that origin as the dial target while minting an identity token for the pinned jurisdiction — so --jurisdiction eu could mint an EU token but still dial the configured (e.g. US) cell. Fix in auth.resolveTargetCellBaseURL: an explicitly pinned jurisdiction on a non-loopback origin now resolves that jurisdiction's own cell from the cluster catalog (reusing resolveCellAPIBaseURL) instead of dialing the origin verbatim. Loopback dev hosts still stay verbatim (single cell, no catalog). Only the new Jurisdiction-pinned-without-BaseURL path is affected; nil-target (home) and BaseURL-set (repo-scoped experts) paths are unchanged.

• Copilot (nit): TestResolveAPITarget now uses the apiTargetCore/ apiTargetCell constants instead of hard-coded "core"/"cell" literals.