refactor(auth): centralize inference-credential routing in CredentialAuthority

One authority answers 'which credential may ride this request':
credential_class / manager_for / credential_for / bearer_resolver_for,
keyed by (platform, base_url). SessionCredential is an opaque type with
no production constructor, so a new call site cannot re-introduce the
session-bearer leak. Platform-scoped tests extended across all bearer
channels (session, aux, summary, subagent override).

Verified: cargo check --workspace --all-targets clean; kigi-shell and
kigi-tui suites green (6611+ tests).

crates/codegen/kigi-shell-base/src/util/mod.rs

@@ -34,7 +34,17 @@ pub fn random_f64() -> f64 {
 pub fn probabilistic_sample(rate: f64) -> bool {
     random_f64() < rate
 }
-fn matches_trusted_base_url(candidate: &str, trusted_base: &str) -> bool {
+/// True when `candidate` is `trusted_base` or a path below it, comparing
+/// scheme, host and effective port exactly (so suffix attacks such as
+/// `api.kimi.com.evil.example` never match).
+///
+/// Public because the credential chokepoint
+/// ([`kigi_shell::auth::credential_authority`](../../../kigi_shell/auth/credential_authority/index.html))
+/// must compare a request URL against the SESSION's effective endpoints
+/// (`[endpoints] coding_api_base_url` from config.toml, `models_base_url`, a
+/// platform's own registry host) — none of which the env-var-only predicates
+/// below can see.
+pub fn matches_trusted_base_url(candidate: &str, trusted_base: &str) -> bool {
     let Ok(candidate) = reqwest::Url::parse(candidate) else {
         return false;
     };