fix: reject malformed --url, correct TTY detection, document mixed-case re-login

[leet-c1]

Three small, independent housekeeping fixes (ledger C108, C106, C97). Each is surgical and self-contained; no shared behavior changes beyond the one guard helper.

C108 — ParseURL rejects a malformed host instead of building a nonsense base URL

The degenerate fallback accepted any input and prepended https://, so https://, //, ://host, or a host with an embedded space/control char became base URLs like https://https:// that only failed later, far from the input. One shared isHostShaped guard now requires a fallback host to be non-empty and free of spaces, control characters, and /; anything else is a usage error (exit 2) naming the source. The main (url.Parse-succeeds) path is unchanged.

• Live-validated against a tenant: https://, ://host, //, ac me.conductor.one, https://ho st each exit 2 with … is not a valid host …; a valid host and a mixed-case host both exit 0 and return rows.
• New TestParseURLRejectsMalformedFallbackHost; the existing degenerate-path test was repointed to an input that still reaches the fallback-with-warning (…@ho%zzst.example) so the credential-drop warning path stays covered. Both mutation-proven (fail before, pass after).

C106 — isTerminal() no longer treats /dev/null as a TTY

os.ModeCharDevice is set for /dev/null too, so a redirected auth login with no URL tried to prompt instead of returning the url is required usage error. Switched to term.IsTerminal(int(os.Stdin.Fd())) (the TTY ioctl). New TestIsTerminalFalseForDevNull (fails on the old code).

C97 — document the mixed-case---url re-login remedy at the point of use

Host lower-casing shipped in v0.4.0, so a credential stored by a pre-v0.4.0 build under a mixed-case keychain key is no longer found. The remedy (re-run auth login) was already in the v0.4.0 changelog but not surfaced anywhere at the point of failure — now added to auth login --help. A true auto-migration would need the pre-lowercase host threaded through the client constructor API, which is out of scope for a housekeeping change; documented instead.

Checks

build, vet, go test -count=1, -shuffle=on, golangci-lint (0), gosec (0), gitleaks (clean), govulncheck (clean), go mod tidy idempotent (adds golang.org/x/term). Two independent reviews (full + delta) — the only finding was the C97 version boundary, fixed.

🤖 Generated with Claude Code