fix: match cell name against cluster URLs before jurisdiction fallback

When a placement-derived group lacks a cluster slug, try matching the group's cell name against cluster ApiUrl/PublicUrl hosts (e.g. cell "aws-eu-central-1" matches "https://aws-eu-central-1.api.entire.io") before falling back to the jurisdiction-level default cluster.

This prevents binding a mirror group to the wrong cell's baseURL when a jurisdiction contains multiple cells — the cell-URL match is precise while the jurisdiction fallback is ambiguous.

Resolution order:

1. Cluster slug join (exact, for home placements)
2. Cell name in cluster URL host (precise, for mirror placements)
3. Default cluster in jurisdiction (fallback)