fix: honor explicit apihost throughout deploy

[mvanhorn]

Changelog

• Treat a non-empty APIHostFlag as the signal that this invocation is intentionally targeting a custom endpoint: preserve its existing precedence in ResolveAPIHost, and bypass automatic rotation of saved credentials so rotation cannot contact a different stored host. In the deploy path, use the resolved explicit host for SLACK_API_URL regardless of whether its first hostname label begins with dev, while retaining current behavior for invocations without an explicit custom host. Move the environment-variable update into a small production helper called by deployApp so host-selection and error behavior can be tested directly, and propagate an AddVariable failure through the existing deploy error path rather than discarding it.

Summary

Treat a non-empty APIHostFlag as the signal that this invocation is intentionally targeting a custom endpoint: preserve its existing precedence in ResolveAPIHost, and bypass automatic rotation of saved credentials so rotation cannot contact a different stored host. In the deploy path, use the resolved explicit host for SLACK_API_URL regardless of whether its first hostname label begins with dev, while retaining current behavior for invocations without an explicit custom host. Move the environment-variable update into a small production helper called by deployApp so host-selection and error behavior can be tested directly, and propagate an AddVariable failure through the existing deploy error path rather than discarding it.

The hidden --apihost flag is intended to direct a CLI invocation to a custom Slack API endpoint, but deploy only writes SLACK_API_URL when the resolved hostname matches the narrower dev* convention. As a result, an explicit endpoint such as api.your.test.endpoint can handle the CLI's API requests while being silently omitted from the deployed app environment. The thread also identifies that credential loading can rotate tokens against a saved host before the explicitly requested host takes effect. The fix must make the explicit flag authoritative for the invocation and report failures instead of silently completing a deploy with inconsistent configuration.

Fixes #129

Preview

(Add screenshots, GIFs, or recordings that show the changes)

Testing

(List the steps used to verify these changes)

Notes

(Add any additional context, trade-offs, or follow-up items)

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

AI was used for assistance.