fix(cmd): --url help still said it was optional

[lakhansamani]

What

One-line fix to the --url flag description.

Was: "Leaving it empty keeps legacy header-based derivation but exposes host-header-injection account takeover (CWE-640) — set this in production"

Is: "REQUIRED: the server refuses to start without it, because deriving its own host from request headers exposes host-header-injection account takeover (CWE-640). This is not --allowed-origins: --url is this server's own address, --allowed-origins is the apps it may redirect to"

Why

#764 made --url mandatory via validateAuthorizerURL, but left the flag's own help text describing the pre-#764 behaviour. authorizer --help therefore documents a configuration the binary rejects at startup — telling operators that omitting it is a supported (if unwise) choice, when it is now a hard failure.

The added --allowed-origins contrast is the same disambiguation the startup error already carries; it belongs in --help too, since confusing the two is the common misconfiguration.

Verification

go build ./... && go vet ./cmd/ # clean
go test ./cmd/ -run 'TestValidateAuthorizerURLRequiresAUsableValue|TestTrustedURLBeatsEveryHeader|TestHeaderDerivationStillWorksWhenUnset'
ok github.com/authorizerdev/authorizer/cmd

Text-only change to a flag description; no behaviour change.

Related

• docs(changelog): record --url becoming mandatory #766 records the same requirement in the changelog
• authorizerdev/docs — the docs sweep; 22 of 24 pages with a runnable command omitted --url

Refs #764