ESD-1624: Stop trusting the page-writable apiURL global in WASM login

[Phil-Browne]

The WASM login path read the outbound API base URL from window.megaportToken.apiURL, a page-writable JS global. Any other script on the page (XSS, a compromised widget, a browser extension) could overwrite it after login and redirect the bearer token to an attacker host, defeating the hostname validation setAuthToken already does.

Both login call sites now read the URL from the MEGAPORT_API_URL env var that setAuthToken sets after validating the portal hostname. The apiURL field on the JS global stays for UI display only, since nothing security-sensitive reads it back.

• loginFunc (token path) and newUnauthenticatedClientFunc now source the base URL from os.Getenv("MEGAPORT_API_URL").
• New js,wasm tests assert both paths route to the validated host even when the JS global is tampered to an attacker URL.
• Added a wasm.yml step so the config package's wasm tests actually run under node in CI (previously compiled but never executed).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.29%. Comparing base (e2074d8) to head (3c8573c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #513   +/-   ##
=======================================
  Coverage   79.29%   79.29%           
=======================================
  Files         193      193           
  Lines       18683    18683           
=======================================
  Hits        14814    14814           
  Misses       2820     2820           
  Partials     1049     1049           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR hardens the WASM authentication flow by ensuring the API base URL used for authenticated and unauthenticated clients is sourced from the hostname-validated MEGAPORT_API_URL env var (set by setAuthToken) rather than a page-writable JS global, reducing risk of token exfiltration via URL redirection.

Changes:

• Updated WASM login and unauthenticated client creation to read the API base URL from os.Getenv("MEGAPORT_API_URL") instead of window.megaportToken.apiURL.
• Added js,wasm unit tests to ensure tampering with the JS global cannot redirect API traffic away from the validated host.
• Updated CI workflow to actually execute the config package’s WASM tests under node.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
internal/commands/config/login_wasm.go	Stops trusting page-writable apiURL JS global; uses validated env-var API base URL for client routing.
internal/commands/config/login_wasm_test.go	Adds WASM tests to assert routing remains pinned to the validated env-var host even if JS globals are tampered.
.github/workflows/wasm.yml	Runs the new WASM config tests in CI so the regression coverage executes.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[penzeliz-megaport]

Reviewed for correctness; no findings. LGTM.

[Phil-Browne]

Merge conflict resolved in c3d43a4