fix(cloud): disclose + confirm login target URL to block config phishing (#400)

[kevinkod]

Closes #400.

Threat

A malicious .specnaut/backlog-config.yml (committed to a repo a victim clones) sets api_url: to an attacker https:// host. specnaut cloud login would then silently run the device/browser flow against it — a phishing vector. (The read commands token/orgs/board were already safe: credentials are keyed by apiUrl, so an unknown/attacker URL yields no stored token → "not authenticated", token never sent.)

Fix (in the shared resolution path)

• resolveApiUrl now returns { url, source } where source ∈ {flag, config, prompt}.
• runLogin discloses the target before opening the browser:

  Connecting to:  https://…
  Source:         project config (.specnaut/backlog-config.yml)
  

• An explicit y/N confirmation fires ONLY on the precise phishing window — source === "config" and no stored creds for that URL (first-ever auth against a config-supplied host). --api-url, an interactively-typed URL, and re-login to a known deployment proceed unprompted, so the init → login happy path keeps no friction. Default-deny (empty/EOF → cancelled, login() never called).

Two pure helpers (urlSourceLabel, loginNeedsTrustConfirm) carry the logic and are unit-tested.

Review

• Architect designed it against the code: keyed-store reality means disclosure beats a blanket gate; no CredentialStore.list() (OS keychains can't enumerate via FFI).
• security-auditor: primary phishing window closed, 0 critical/high, no bypass found, confirm is default-deny, refactor introduces no regression. One residual Medium — re-login to a URL the user already confirmed once skips the re-confirm (the disclosure line still renders every time) — acknowledged in-code; acceptable for the threat model.

Out of scope / residual

The config-URL-swap-after-prior-auth case (requires the user to have already approved that URL once) is documented in the code comment; not addressed here to avoid scope creep.

Verification

deno task lint + deno task check clean · deno task test 1036/1036 · smoke of cloud token/logout URL resolution ✓

Agent adoption

specnaut cloud login (and the specnaut login alias) now prints the target server URL and where it came from before opening the browser, and asks for confirmation the first time you authenticate against a URL that came from a project's .specnaut/backlog-config.yml. No action needed for normal use; it's a security disclosure.

Check whether any docs or onboarding notes in my project describe the
`specnaut cloud login` flow (in README.md, AGENTS.md, CLAUDE.md, or
.claude/**). If they do, add a one-line note that login now shows the target
server URL + source and confirms first-time auth against a config-supplied
URL. Open a PR with the change.

🤖 Generated with Claude Code