auth: add context-aware control-plane target resolver

ResolveControlPlaneTarget picks the core + bearer for control-plane commands from the active contexts.json login instead of always using the static AuthBaseURL default. Precedence: explicit ENTIRE_AUTH_BASE_URL override -> active context (per-context refreshing bearer, keyed on its own CoreURL so refresh/STS hit the right core) -> static default.

Adds the two readers it needs: api.AuthBaseURLOverridden() and auth.insecureHTTPEnabled(). Not yet wired into coreapi.