bug: keyring session store keys entries by host, so http and https deployments share a token #29290

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The keyring session store keys entries by host only. normalizeHost in cli/sessionstore/sessionstore.go returns strings.ToLower(u.Host), so http://coder.example.com and https://coder.example.com map to the same entry. Every command that runs with --url http://coder.example.com and --use-keyring=true therefore uses the token that was stored for the https deployment:

• coder login token --url http://coder.example.com prints the https token.
• coder logout --url http://coder.example.com sends that token to http://coder.example.com in client.Logout() and then deletes the shared entry, signing the https session out.
• Any other command, such as coder ssh, sends the https token in cleartext to the http URL.
• coder login http://coder.example.com --use-token-as-session overwrites the https entry with the http token.

File mode already guards against this. coder login token compares the stored URL with --url and refuses with file session token storage only supports one server at a time when they differ. The keyring path has no such check.

The main way to hit this is a mistyped or misconfigured URL: a user who is signed in to https://coder.example.com in the terminal and points a client at http://coder.example.com leaks the https token over plaintext. The VS Code extension defaults coder.useKeyring to true in coder/vscode-coder#1107 and shares the CLI's store, so the same host-keyed entry is used by both.

Relevant Log Output

$ coder login https://coder.example.com --use-keyring=true
# ...signed in...
$ coder login token --url http://coder.example.com --use-keyring=true
<prints the https session token>

Expected Behavior

Keyring entries are scoped to the full origin (scheme, host, and port), or the keyring read compares the stored URL with --url the way file mode does and refuses on a mismatch. Either way, coder login token --url http://coder.example.com fails with a clear error instead of printing a token for a different scheme.

Steps to Reproduce

1. On macOS or Windows, run coder login https://coder.example.com --use-keyring=true and sign in.
2. Run coder login token --url http://coder.example.com --use-keyring=true.
3. The https session token is printed. Running coder logout --url http://coder.example.com --use-keyring=true sends it to the http URL and removes the https session.

Environment

• Host OS: macOS or Windows (any platform with keyring support)
• Coder Version: main at 9548f23 (after 2.32.0)

Additional Context

Related to #29105, which also touches how clients share the CLI's keyring store.