Drop SP_BASE_URL and SP_API_TOKEN from the test environment

[cfsmp3]

The symptom

$ export SP_BASE_URL=https://sampleplatform.ccextractor.org/api/v1
$ python -m pytest -q
1 failed, 215 passed

Unset the variable and the same commit is green. This showed up right after #3 merged, on master, with no code change between the two runs — only the environment differed.

The cause

tests/__init__.py sandboxes HOME and XDG_CONFIG_HOME, which covers the config file. But the CLI also takes settings from the environment through click's envvar= (main.py:31-33):

@click.option('--base-url', envvar='SP_BASE_URL', default=DEFAULT_BASE_URL, ...)
@click.option('--token', envvar='SP_API_TOKEN', default=None, ...)

The failing test asserts that a saved session beats the default base URL. An exported SP_BASE_URL outranks the saved value, so the assertion fails — correctly, given the environment it was handed.

SP_API_TOKEN is the more dangerous of the two: a real token sitting in the environment quietly becomes test input.

CI has never caught this because it sets neither variable. It only bites someone running the suite on the same machine they drive the CLI from — which is everyone working on this tool.

The fix

Pop both in the existing sandbox block, next to the HOME/XDG_CONFIG_HOME redirect.

Testing

environment	runner	result
SP_BASE_URL + SP_API_TOKEN set	pytest	216 pass
SP_BASE_URL + SP_API_TOKEN set	unittest discover	OK
neither set	pytest	216 pass

isort, pycodestyle, pydocstyle and mypy all clean. Saved token verified unchanged (md5) after every run.

Same family as #2: the suite's isolation covered the file but not the environment.