api: add entire-api URL/audience template resolution

entire-api (the per-cell product API) is addressed differently from the data API: a per-cell host plus a jurisdictional identity token whose audience is a separate value, both filled from the target repo's mirror. Port entire.io/api's lib/entire-api buildBaseUrl/buildAudience/ buildCoreBaseUrl as validated Go helpers over three operator templates:

ENTIRE_API_BASE_URL_TEMPLATE ({cell}) → host ENTIRE_API_AUDIENCE_TEMPLATE ({jurisdiction}) → token audience ENTIRE_CORE_BASE_URL_TEMPLATE ({jurisdiction}) → token-minting core

Unlike the JS originals these fail loudly on an empty/unsubstituted template rather than dialing a broken host; the core template keeps the single-core fallback (empty → the active context's core) so existing deployments are unaffected. Pure functions plus env readers; no wiring yet.