fix(errors): name the failing API from one place - #38

PR #38 improved the org-resolution error by hand-rolling a message that
named the failing API. That fixed one site and left the other 123 on the
shared formatter, so the CLI grew a second error format.

Move the idea into handle_http_error instead, and route the outliers
through it:

- handle_http_error names the API when the host isn't the public default.
  The host is configurable via AVR_HOST or hosts.json, so on a self-hosted
  or staging endpoint a bare status never said which API answered. On the
  default host it stays quiet, where the URL is noise on every error.
- _fetch_user_orgs and get_verified_org_slug now use the shared formatter.
  Org resolution is usually the first authenticated request a command
  makes, so it is where a stale token surfaces: it was the one place that
  reported a raw 401 instead of the auth hint and exit 4 that scripts
  check for.
- Repo resolution no longer renders httpx's own exception string (a
  two-line message ending in an MDN link) for non-404 failures.
- The login flow keeps its own handling, since a 401 there means the
  browser session expired rather than "go run avr auth login", but its
  two handlers now name the host like the rest of that file already did.

Tests pin both halves of the host rule, the 401 exit code at both
migrated sites, and the absence of httpx internals in repo errors.

Mutation testing the previous commit found three changes that kept the
suite green when reverted, so they were not actually pinned:

- The 401 branch names the API in a sentence of its own, but the only 401
  test used the default host, where that sentence is suppressed. Deleting
  the line changed nothing observable. Now covered from both sides:
  named on a custom host, absent on the default one.
- get_verified_org_slug's move onto the shared formatter was never
  executed. Its existing tests cover a transport error and a non-JSON
  200, neither of which is an HTTPStatusError.
- The login flow's split between status and transport errors was never
  executed. Added a fixture that drives login() to the API-key exchange
  with no browser and no socket, following the pattern already used in
  test_auth_sso.

All twelve mutants are now caught, including full reverts of each
migrated call site.