cli/auth: address review nits on entire-api cell routing

Follow-ups from the 715 review:

• Case-fold the home_jurisdiction claim from the login JWT before the strict [a-z0-9-] label check. The repo-target path already lowercases; the JWT path did not, so an uppercase claim would hard-fail instead of routing.
• List the cluster catalog in the home-jurisdiction fallback against the discovered login core (selected.CoreURL) rather than the templated jurisdiction core — the login JWT is signed by the former, so in a multi-core setup the templated core could reject it. The exchange core is unchanged.
• Add the ErrNoCellForJurisdiction sentinel and wrap the "no cell / no apiUrl" errors with it, so callers with a data-API fallback (activity, recap next) can degrade instead of failing when a region has no cell.