Active-token URL fallback

Chose explicit configuration, then active-token host, then DEFAULT_SENTRY_URL for getApiBaseUrl() and getControlSiloUrl() over stored-OAuth region fallback because routing must follow auth precedence. Stored OAuth wins normally; when SENTRY_FORCE_ENV_TOKEN=1, the environment token’s sntrys_ claim wins and cached OAuth regions must never apply. Fetch-layer host guards still reject mismatched origins.