fix(auth): bump API host to v2-12-3 and add LIFTOFF_API_BASE override

[DTTerastar]

Summary

• Liftoff retired the v2-12-2 host with "The server is deprecated.", breaking every authenticated subcommand once the cached access token expires. Bumps the compiled-in default to v2-12-3 (probed: v2-12-3 is the only live host right now — v2-13-0..2 also return deprecated; v2-14+ don't resolve).
• Adds a LIFTOFF_API_BASE env-var override so the next deprecation can be worked around without waiting on a release. Logged once to stderr when the override is in effect.
• Surfaces an actionable error when the backend returns the deprecation marker, from auth refresh, auth login, or any authenticated tRPC query — points users at the env-var workaround and notes that the Liftoff iOS/Android app shows its version under Settings → About.

Why this design

• Env-var override + clear error beats automatic version probing/fallback in the CLI; probing would silently mask real breakage.
• tokenURL/path stays unchanged — only the host varies between Liftoff versions.
• Tokens are user-bound, not host-bound: existing ~/.config/liftoff-export/auth.json survives the version bump (verified locally — workouts list --since 7d succeeded with the previous token against the new default).

Test plan

• go build ./... && go vet ./... clean
• LIFTOFF_API_BASE=https://v2-12-2.api.getgymbros.com liftoff-export auth refresh → emits override banner, then actionable deprecation error (not bare upstream text)
• liftoff-export auth refresh (no override, default v2-12-3) → succeeds
• liftoff-export workouts list --since 7d → returns real workouts via tRPC
• After release: re-run morning Liftoff digest end-to-end to confirm it feeds the coach again

Followup (release)

After merge, cut v1.0.6 so the goreleaser workflow rebuilds the five platform binaries + checksums. Hold for explicit go-ahead before tagging.