fix: jurisdiction fallback prefers default cluster

When multiple clusters exist in a jurisdiction, the jurisdiction fallback now picks the one with IsDefault=true, matching the auth layer's resolution. Previously first-seen won, which could resolve a non-default cell API URL.