fix: display the core a request actually dials (mirror list, auth status)

The mirror list stderr banner re-derived its core via ResolveControlPlaneTarget, which ignores ENTIRE_TOKEN. In env-token mode the request instead dials the token's own aud, so with both ENTIRE_TOKEN and a contexts.json present the banner named a core the request never talks to. The precedence (env-token-then-active-context) lives only inside coreapi.New, and the client hid its resolved core, so every "talking to X" display site was forced to re-derive it and could get it wrong.

Add coreapi.Client.CoreOrigin() — the single source of truth for "which core am I dialing", reporting whatever was wired in (active context, NewForCluster's cluster core, or the ENTIRE_TOKEN aud). Render the mirror list banner from the live client's CoreOrigin so it can never diverge from the request; this also makes it correct (rather than suppressed) in env-token mode.

Fix entire auth status the same way: it builds its own /me client outside coreapi, so it now applies the env-token-first precedence and reports the env token's core + bearer instead of a stale active context. logout stays on the active context: it manages a stored session, which an env token lacks.

Extract auth.ParseEnvToken as the single owner of the ENTIRE_TOKEN trim/blank/aud-validation sequence, shared by coreapi.New's bypass and auth status (was duplicated inline in both).

Document the convention in CLAUDE.md: to show which core, ask the client (CoreOrigin); never re-resolve for display.