fix: prepend api. prefix in NullifyClient and use POST for metrics overview

[jonathanlam]

Summary

• NullifyClient and refreshingAuthTransport were building BaseURL without the api. prefix (e.g. https://x.nullify.ai instead of https://api.x.nullify.ai), causing TLS errors on all requests through the legacy client
• authTransport was overriding the request URL host on every round-trip, reverting the correct host set by BaseURL
• status command was using GET for /admin/metrics/overview, which is a POST endpoint requiring a {"query":{}} body

Test plan

• nullify status returns full security posture overview
• nullify repos lists repositories
• nullify findings --type sast returns findings
• All unit tests pass (make unit)