auth: make `auth status` context-aware; hit /me on the active core

auth status queried /me against the static api.AuthBaseURL(), so with an active context on a different core (e.g. auth use eu.auth.entire.io while AuthBaseURL defaults to us.*) it sent the context's token to the wrong core and got a 401 — surfaced as a raw ogen decode dump because the 401 body was text/plain.

• Resolve the active contexts.json context first (resolveStatusTarget): use its CoreURL + session token, falling back to AuthBaseURL + the legacy keyring entry only when no context is active. auth use now retargets status. "Logged in to <core>" reflects the active context.
• Add coreapi.NewWithBearer(coreURL, token) to hit a specific login server with a fixed bearer (no STS), used by status's /me.
• Harden isKeychainTokenRejected: a non-JSON 401 (ogen "decode response: ... (code 401)") now maps to the friendly re-login hint, not a raw dump.
• TLS-guard the resolved context core URL before sending the token.