Separate CLI and service server configs

[floitsch]

Depends on #1256.

Summary

• split the CLI-side ServerConfig hierarchy from the service-side BrokerConfig
• replace HTTP and Supabase host/port/path/use_tls fields with complete base URLs
• use URI-based HTTP requests throughout the CLI transport and authentication paths
• normalize Supabase certificates to the same root-certificate list used by HTTP configs
• keep existing CLI and fleet configurations readable while writing only the new URL-based shape

The CLI configuration still owns backend selection, authentication inputs, fleet scope, and the polling policy used when generating a service configuration. The generated BrokerConfig contains only the five operation URL templates, root certificates, optional device headers, and polling policy; it has no CLI server name, scope, backend type, or Supabase-specific state.

HTTP versus HTTPS is now determined solely by each URL. There is no separate TLS flag in newly written configurations.

Compatibility

Old supabase and toit-http JSON containing host, port, path, use_tls, and the singular Supabase certificate fields is accepted and converted in memory. Newly serialized CLI configuration uses url and the common root-certificate list.

Testing

• static analysis of all changed source and test files
• toit run --project-root tests tests/server-config-test.toit
• toit run --project-root tests tests/auth-provider-test.toit -- --http-server
• toit run --project-root tests tests/broker-test.toit -- --http-toit-broker
• toit run --project-root tests tests/broker-test.toit -- --http-toit-combined-broker