Add LC_API_URL and LC_JWT_URL to target a non-public deployment

[maximelb]

Why

The SDK and CLI always use https://api.limacharlie.io and https://jwt.limacharlie.io. There was no way to point them at another deployment, such as a local development stack, short of patching the module.

What

• LC_API_URL overrides the API root (ROOT_URL), LC_JWT_URL the token-exchange endpoint (JWT_URL). Both are read once at import.
• Unset or empty keeps the public roots, so nothing changes for anyone who does not set them.
• A value that is not an absolute http:// or https:// URL raises instead of silently falling back to the public API (which would send the caller's key somewhere they did not intend).
• A trailing / is stripped.
• limacharlie api --target jwt follows LC_JWT_URL (the api target already used ROOT_URL).
• Documented in doc/authentication.md.

Tests

tests/unit/test_client_root_override.py: unset, empty, override + normalization, three malformed values, and a real-HTTP-server check that a client built under the overrides exchanges its key at LC_JWT_URL and calls LC_API_URL/v1/.... The full unit + microbenchmark suite passes (4572 passed).

🤖 Generated with Claude Code

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/python-limacharlie c2a7912…fd27b63 — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.

[maximelb]

Self-review (pristine git archive of the head): unset/empty keeps both public roots; a malformed value raises at import rather than silently falling back; the only consumers of the roots are _call_jwt_endpoint and _rest_call (plus api --target jwt, now following LC_JWT_URL). No open issues. Verified live: LC_API_URL=http://127.0.0.1:9090 LC_JWT_URL=http://127.0.0.1:8135 limacharlie mailsec message list returns a local development stack's messages.