api: delete AuthBaseURL(); the env var is gate-only (COR-393)

No reader of ENTIRE_AUTH_BASE_URL remains: every token path resolves its core from contexts.json or /.well-known discovery, and login takes --server. The constant DefaultAuthBaseURL stays as the --server default, and AuthBaseURLEnvVar stays only for RejectRemovedAuthEnv. NewAuthenticatedAPIClient now TLS-checks just the data origin it actually dials; the exchange leg is guarded by the per-context token manager.