API token sent to URL dictated by an untrusted project .weblate file

`wlc` discovers project configuration by walking the current working directory and **every parent directory** for `.weblate` / `.weblate.ini` / `weblate.ini` (`WeblateConfig.find_project_config`). That file sets the API `url`. The API key, however, is resolved independently and is **not bound to a …

# wlc/config.py:67-94  @ 7c01e2f
@staticmethod
def find_project_config() -> str | None:
    """Find the nearest project configuration file."""
    cwd = os.path.abspath(".")
    prev = None
    while cwd != prev:                       # walk CWD and every ancestor
        for name in (".weblate", …