fix(cli): Route org-auth tokens to their instance

[BYK]

Summary

• Resolve Env org-auth token host claim ignored when picking request base URL cli#1568 in Toolkit by routing requests, web links, and trusted proxy headers through the active credential host unless an explicit Sentry URL takes precedence.
• Pin credential identity and host across organization discovery, pagination, refresh, SDK calls, redirects, and response caching. Scope organization-region rows by credential and source origin; schema v17 discards rows without provable provenance.
• Persist region rows only after every organization page succeeds, fetch discovery responses with verified provenance, and retain pinned OAuth sessions across refresh-token rotation without admitting another login. Derive cache keys with HMAC-SHA-256 keyed by the credential fingerprint.
• Preserve self-hosted installation paths in region URLs, document token-claim routing, and cover migration, concurrent logins, redirects, refresh, and cache behavior with regressions.

Supersedes getsentry/cli#1575.

Validation

• CLI unit suite: 10,309 passed, 13 skipped; targeted cache/discovery tests after the latest cache-key change: 48 passed.
• CLI typecheck and Biome, root typecheck and lint/ast-grep, and generated-definition checks passed. Root lint reports two pre-existing MCP Cloudflare warnings.
• Exact-head GitHub checks are running.

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit eb42e75. Configure here.}