cli: reject non-origin-relative paths in `entire api` (token-leak fix)

entire api <path> resolves <path> against the backend origin via url.ResolveReference, and the bearer transport attaches Authorization to the result. An absolute (https://evil/…) or scheme-relative (//evil/…) path replaces the host, so the request — with the Entire token — would be sent to an attacker-controlled host (over plain http too, bypassing the base-URL TLS check).

Validate the expanded path with validateAPIPath before any request: reject anything carrying its own scheme or host. Verified a pre-fix build sent the bearer to example.com; post-fix it's refused.