coreapi: resolve New() host + token via the active context

New() now consults auth.ResolveControlPlaneTarget for its host and bearer, so entire auth use <ctx> retargets org/repo/project/grant onto that context's core and their tokens refresh silently. Replaces bearerSource with a token-func-backed providerSource; NewWithBearer (auth status) is untouched.