feat(cli): thread Config into the Pathbase path

[ecalifornica]

Part of #184 (PR 9 of the plan there). Stacked on the share PR (branch
robert/config-share). The resume PR (branch robert/config-resume) stacks on
this one. path-cli only.

What

• cmd_pathbase::resolve_url takes &Config and reads the server override from
  config.pathbase_url.
• cmd_pathbase::credentials_path and cmd_pathbase::preflight_auth take
  &Config and locate the credentials file through Config::config_dir.
• cmd_pathbase reads no environment variable. It stops re-exporting
  PATHBASE_URL_ENV; config.rs is the only user of that constant.
• normalize_url strips one trailing /. resolve_url calls it.
  derive::parse_pathbase_ref calls it for the --url flag, where the flag
  value always wins, so that function needs no Config.
• run() passes &Config to cmd_auth::run. cmd_auth::login takes it and
  calls resolve_url.
• cmd_export::run_pathbase and cmd_export::resolve_upload_base_url take
  &Config. The p export dispatch passes the &Config it already holds.
• cmd_share::run passes its &Config to resolve_upload_base_url and to both
  preflight_auth calls.
• derive::pathbase_fetch_to_doc takes &Config. The p import pathbase arm
  passes the &Config it already holds. cmd_resume is threaded by its own PR;
  resolve_input loads a transitional Config at that call site.
• cache.rs still resolves its directory through the free config_dir(). A
  later PR owns it.

Emscripten

• cmd_pathbase and cmd_auth are #[cfg(not(target_os = "emscripten"))] modules; the emscripten bail arms in cmd_import and cmd_export consume the &Config they receive.

Behavior change

• None. Server-URL precedence stays --url flag, then $PATHBASE_URL, then
  https://pathbase.dev.

Tests

• Two new unit tests inject a Config in place of an environment variable:
  resolve_url_falls_back_to_config_then_default and
  credentials_path_sits_under_the_config_dir.
• The 5 preflight_auth tests inject a Config carrying a tempdir config dir.
  They drop their $TOOLPATH_CONFIG_DIR scaffolding and the shared
  TEST_ENV_LOCK guard, so they no longer serialize against the rest of the
  suite. The EnvGuard helper is deleted; those 5 tests were its only users.
• cmd_export's pathbase_repo_flag_requires_login injects a Config and
  drops its $TOOLPATH_CONFIG_DIR save/restore block and its TEST_ENV_LOCK
  guard.
• derive's pathbase_fetch_to_doc_url_input passes a Config rooted at a
  tempdir, so it reads no ambient credentials.
• No integration test sets $PATHBASE_URL: the 12 Pathbase integration tests
  pass --url, which is the flag layer. The $PATHBASE_URL layer is covered by
  the config.rs figment jail test.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

🔍 Preview deployed: https://dd60415a.toolpath.pages.dev