Resolve the auth proxy and provisioning endpoints at the composition root #913

AuthProxyEndpoint.Url and ProvisioningEndpoint.Url are static properties that
read KCAP_AUTH_PROXY_URL and KCAP_SIGNUP_URL from the environment on every
read. Twelve production sites reach them that way, across the onboarding facade,
the login flow, kcap setup, kcap login, kcap machine, the join's first-hop
URL and the desktop wizard.

Two costs. The value can change under a single run, since nothing pins it — the
process that resolves an endpoint and the process that reports it to the operator
can answer differently. And a test that wants the override has to set a process
-wide variable: AuthProxyEndpointTests guards one with a keyed NotInParallel,
which is unsound, because every other reader of that property sits outside the
key.

Resolve both at the composition root and inject them, as ConfigRoot, UserHome,
MachineAuth and the clock already are. MachineAuth.TokenUrlOverride is the
shape to copy: the override is carried as data and the URL derived from it, so the
static classes go rather than gaining a setter.

Out of scope: KCAP_URL and KCAP_PROFILE, which ProfileOverrides already
resolves as an injected value.