test(hooks): make #450 no-synchronous-dial assertion load-bearing

The SessionStart guard pointed ENTIRE_API_BASE_URL at a plain-http sentinel, but api.RequireSecureURL rejects http before any dial — so a regression to inline dialing bailed pre-dial and the dialed/elapsed assertions could never fire; only the spawn-count check actually caught it. Point the API base at a blackholed https host that accepts the TCP connection but never answers: an inline dial now passes the security gate and stalls to the 1s session-start deadline, so a synchronous regression trips all three assertions (spawn hand-off, dialed>0, ~1s block). Verified by mutating the fix back to a synchronous refresh.