Replace openbao_from_env_with_url with openbao_source(namespace, openbao_url,
zitadel_sso_url): each URL overrides its env var (OPENBAO_URL/VAULT_ADDR,
HARMONY_SSO_URL) when Some, else falls through to env. The deploy context passes
its openbao_url + zitadel_url straight into the source instead of mutating
process env — drops the unsafe set_var. ClusterAccess is read from an
OpenBao-only client and the resolve match collapses back to one OpenBao arm.
INFO now states the resolved context, profile, and which cluster source is used
(autoprovision k3d / existing k3d / OpenBao); DEBUG dumps the context definition.
Wire the context's zitadel_url into HARMONY_SSO_URL so the OpenBao rung uses it
instead of silently falling back to the ambient env.
AppContext parses openbao_url/zitadel_url and builds the OpenBao config source
from the context URL via harmony_config::openbao_from_env_with_url, instead of
requiring OPENBAO_URL in the ambient env. A prod context can point at its own
OpenBao directly.
