pub fn api_base(override_: Option<&str>) -> String
Resolve the API base: explicit override → process environment → authoritative V2 record → default.
The legacy keychain slot is import-only and is never consulted here.