cli/api: add `--jurisdiction` and document the command

entire api --to cell only reached the caller's home entire-api cell. Add --jurisdiction <slug> (e.g. us, eu) to target a specific jurisdiction's cell instead, reusing the existing cell machinery: it passes auth.CellTarget{Jurisdiction: slug} into NewEntireAPICellClient, which mints the jurisdictional identity token and resolves that jurisdiction's cell URL. No new exchange/URL/security logic.

--jurisdiction targets a cell, so it implies --to cell; combining it with an explicit --to core is a contradiction and errors clearly. The slug is normalized to a bare lowercase DNS label (US/" us " -> us).

Surface it to agents: the command was already visible in entire help and entire agent-help, and agent-help renders live from the Cobra tree, so the updated Long/Example/flag-usage explain --jurisdiction automatically on drill-down. Also document entire api in CLAUDE.md, which was missing it entirely.