feat(cli): interactive register server picker + Bitwarden-cloud routing

[UnbreakableMJ]

Summary

vault register with no --server on a terminal now presents a server picker instead of erroring:

Select a server:
  1) Bitwarden cloud — US (bitwarden.com)
  2) Bitwarden cloud — EU (bitwarden.eu)
  3) Vaultwarden / other self-hosted (enter URL)

Choosing a cloud option is only honest because this PR also wires split-domain routing into the agent. Previously the live unlock path (ensure_online, online_unlock) always built <server>/api + <server>/identity (the Vaultwarden single-origin shape), so bitwarden.com/.eu could never connect — the split constructor bitwarden_hosted() existed but had zero call sites.

Changes

vault-api

• BaseUrls::bitwarden_eu() — api.bitwarden.eu + identity.bitwarden.eu, mirroring bitwarden_hosted().
• BaseUrls::infer_from(server) — routes *.bitwarden.com → US split, *.bitwarden.eu → EU split, else self_hosted. This is the method the orphaned error.rs doc comment already referenced. The suffix match is apex-anchored, so lookalike hosts (bitwarden.com.evil.example) fall through to self_hosted.
• 6 new infer_from tests in tests/parsing.rs.

vault-agent

• ensure_online (state.rs) and online_unlock (unlock.rs) call infer_from instead of self_hosted. The stored server string and account_dir_name cache-dir scheme are untouched, so existing caches don't orphan.

vault-cli

• cmd_register resolves server/email via new resolve_register_server / resolve_register_email: flag → env → (TTY only) prompt. Off a TTY with neither flag nor env, it prints the same vault: missing --server (or $VAULT_SERVER) and exits 2 — the non-interactive contract is preserved (piped/scripted register never hangs).
• single-use resolve_arg replaced by the non-erroring arg_or_env helper.

Advances the still-open PRD §11.1 end-to-end-against-bitwarden.com gate.

Verification

• infer_from unit tests (US/EU/subdomain/self-host/lookalike/garbage) — pass.
• CI-exact fresh-isolated clippy (-D warnings) — clean.
• RUSTFLAGS="-D warnings" cargo test --workspace --all-targets — all pass, 0 failures.
• Non-interactive contract: printf '' | vault register → vault: missing --server (or $VAULT_SERVER), exit 2 (no hang). Verified.
• Manual interactive picker + live register → login → sync against bitwarden.com is the maintainer step (real account).

🤖 Generated with Claude Code