fix(api): derive default API base URL from the login environment

[dealako]

Summary

When --hostname is not passed, lfx api now takes its base URL from the compiled-in default API audience for the login's environment (see lfx auth environments), instead of from the audience value stored in state.json.

If the stored audience differs from that environment's default, lfx api refuses the request with an error telling the user to re-run lfx auth login (or, for development logins, to pass --hostname explicitly). This works like the existing check in loadDeviceStateForBackend that the stored IdP domain matches the environment.

Changes

• internal/commands/api.go: new apiDefaultBaseURL helper, used by runAPI when --hostname is not set; removes the now-unreachable "no API base URL available" branch.
• internal/commands/api_test.go: table tests for apiDefaultBaseURL, plus an end-to-end lfx api test against a local server showing that no request is sent when the stored audience doesn't match the environment default.
• internal/commands/auth.go, internal/credstore/credstore.go: doc-comment updates describing how the stored audience is now used.
• README.md: notes the lfx api base URL behavior.

Behavior changes

• Logins made with a non-default lfx auth login --audience can no longer use lfx api without --hostname. Development logins can pass --hostname on each call; for production and staging, re-run lfx auth login with the default audience. lfx auth token is unaffected.
• State files from before default audiences became environment-specific (staging/development logins that stored the production audience) will get an error asking the user to run lfx auth login again.

Suggested release: patch.

Testing

• go test ./..., go vet ./..., gofmt, and golangci-lint run ./... all pass. revive was not available locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L8qMuq3je1uuU2JMLHuYBG

---

Generated by Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation and coverage are sound; the remaining README wording issue is non-blocking.

Review effort: Balanced
Findings: 1

Open (1)

• Clarify hostname behavior when no override is supplied · New

What changed in this PR

Derives the default lfx api base URL from the authenticated environment rather than persisted audience data.

Changes:

• Validates stored audiences against compiled-in environment defaults.
• Documents the updated audience and API routing behavior.
• Adds unit and integration coverage for mismatched audiences.

File	Description
README.md	Documents default API routing behavior.
internal/​commands/​api.go	Adds environment-based URL selection and validation.
internal/​commands/​api_test.go	Tests defaults and mismatch refusal.
internal/​commands/​auth.go	Updates token-resolution documentation.
internal/​credstore/​credstore.go	Clarifies persisted audience usage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the stated security behavior and includes focused regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Clarify hostname behavior when no override is supplied