chore(cli): remove legacy api url alias

[StevenACZ]

Summary

• Remove the final legacy LucasApp production API URL alias from CLI config resolution
• Release lucasapp-cli 0.6.8 with direct api.lucasapp.app-only production config
• Keep generic URL normalization for whitespace/trailing slashes

Verification

• bun run format:check && bun run typecheck && bun run lint && bun run test && bun run build
• npm pack --dry-run --json --ignore-scripts
• bun run src/index.ts auth status
• bun run src/index.ts investments instruments --rank popular --limit 1
• rg legacy domain checks across repos/docs excluding .bak and ops-logs

Security

• Diff-scoped review found no reportable security candidates; no secrets or auth logic were added.