Note when an exported key goes to a stored endpoint

[jon-trust]

What

Commands now print a note on stderr when a key exported in TOC_API_KEY is about to be sent to a non-default endpoint that tmxcaliber init stored in the credentials file, and TOC_API_URL is unset:

Note: the key in TOC_API_KEY will be sent to <endpoint>, the endpoint stored in <credentials file>. Set TOC_API_URL to choose a different endpoint.

Why

The key and the endpoint are resolved independently, on purpose (see the comment in load_settings). So a key exported for one API, while init once stored a different endpoint, is sent to that stored endpoint with nothing on screen to say so. Resolution is unchanged; this only makes it visible.

How

• Settings.endpoint_source records where the endpoint came from, and Settings.sends_environment_key_to_stored_endpoint owns the condition. The library still prints nothing.
• remote_cli.connect() is the one place a client is built from resolved settings, and the one place the note is written. Every API command goes through it (run_api_command), and so does every ThreatModel reference given as a document source (resolve_command_source).
• The note is printed once per run, before the first request, on stderr. Stdout is unchanged, so JSON output stays parseable.
• A local file source still needs no key: connect is only called for a reference.
• init is unchanged and keeps its own TOC_API_KEY note.

Version

0.5.4, since 0.5.3 shipped with #46.

Checks run locally

• uv run coverage run ./test/run_tests.py: 578 passed
• uv run ruff format --check ., uv run ruff check ., uv run mypy: clean
• uv build and twine check: passed