fix: suppress gosec false positives for trusted URL construction

Add nolint:gosec annotations for:
- Client.Do calls using URLs built from trusted BaseURL + hardcoded paths
- Test helper HTTP calls using test server URLs
- Safe integer-to-rune conversion in bounded loop (0-19)

cmd/chat-cli/api/client.go

@@ -125,7 +125,7 @@ func (c *Client) PollMessages(
 
 	req.Header.Set("Authorization", "Bearer "+c.Token)
 
-	resp, err := client.Do(req)
+	resp, err := client.Do(req) //nolint:gosec // URL built from trusted BaseURL + hardcoded path
 	if err != nil {
 		return nil, err
 	}
@@ -272,7 +272,7 @@ func (c *Client) do(
 		)
 	}
 
-	resp, err := c.HTTPClient.Do(req)
+	resp, err := c.HTTPClient.Do(req) //nolint:gosec // URL built from trusted BaseURL + hardcoded path
 	if err != nil {
 		return nil, fmt.Errorf("http: %w", err)
 	}