Resolve builds the effective config from the three sources in priority
order: explicit flag, then environment, then the config file. baseURLFlag
and apiKeyFlag are the raw values from cobra (empty string means "not set").
Source describes where a resolved API key came from. Useful for `auth status`
so we can tell the user how their key is being picked up without ever
printing the key itself.