auth: active context wins over ENTIRE_AUTH_BASE_URL for control plane

Make ResolveControlPlaneTarget match auth status: the active context always drives host+token; ENTIRE_AUTH_BASE_URL is only the fallback when no context is active, not an override. A token minted by the context's core can't authenticate against a different host, so "override host + context identity" can't succeed — the active context is authoritative.

Drops the now-unused api.AuthBaseURLOverridden() helper.