cli/api: keep the bearer on its origin across redirects and cross-host paths

The api.Client used the default redirect-following http.Client and re-added Authorization on every hop, so a backend redirect to another host — or a path that resolved cross-host — would carry the Entire token off-origin (the earlier path check only guarded entire api's own input).

• do() now rejects any request whose resolved host differs from the base URL's host (checked against the live c.baseURL, so it stays correct even when callers reassign baseURL).
• CheckRedirect refuses a redirect to a different host than the original.

Together the token is only ever sent to the API's own host. Also make the logged-out core path in entire api return a normal (non-silent) error so the "run 'entire login'" hint is printed instead of a bare non-zero exit.