[FIX] sync surf API spec from configured base

[ZhimaoL]

Summary

• make SURF_API_BASE_URL / --surf-api-base-url apply to surf sync and lazy auto-sync, not only operation requests
• stamp cached API specs with the configured API base and treat mismatched-base cache as a miss
• fix command detection when global flags with values appear before the command
• add regression tests for env-specific sync, configured-base sync, and prod/stg cache isolation

Why

STG runners can set SURF_API_BASE_URL=https://api.stg.ask.surf/gateway/v1, but current surf sync and cache-miss lazy sync still load the prod gateway spec. That can make STG agents use prod OpenAPI cache, miss STG-only endpoints, and add cache-miss sync latency/noise to eval runs.

Test plan

• go test ./...
• built a local binary and verified real STG sync:
  • SURF_API_BASE_URL=https://api.stg.ask.surf/gateway/v1 surf sync
  • surf list-operations shows hyperliquid-account, hyperliquid-fills, hyperliquid-leaderboard, hyperliquid-positions, hyperliquid-trader-stats
• verified config.json records surf.base=https://api.stg.ask.surf/gateway