fix: Handle HTTP redirects for migrated instances in sharing sync

[shepilov]

Summary

• Detect when sharing requests are redirected to a new domain and automatically update the member instance URL
• Fix "No token in request" errors when syncing sharings with migrated instances that use 302 redirects

Problem

When an instance is migrated from one domain to another (e.g., alice.mycozy.cloud → alice.twake.app) using 302 redirects instead of the official move functionality, sharing sync fails with Unauthorized: {"error":"No token in request"}. When Go's http.Client follows a 302 redirect to a different host, it strips the Authorization header for security reasons (to prevent credential leakage to untrusted domains).

So:

1. Request goes to old domain with Authorization: Bearer
2. Server returns 302 Redirect to new domain
3. Go follows redirect but strips the Authorization header
4. Request arrives at new domain without token → 401 Unauthorized

Solution

Detect redirects by comparing the response's final URL (res.Request.URL) with the original request domain. When a cross-host redirect is detected:

1. Update member.Instance to the new domain
2. Refresh the access token (which persists the sharing document with the updated member URL)
3. Retry the request to the new domain

[taratatach]

Looks like tryUpdateMemberInstance(err, m, opts) is called only if the error status is 410 Gone while we update opts.Domain if the error status is 401 Unauthorized.
Should we change the condition on line (newly) 666?

[taratatach]

Can't we simply reuse res.Request.URL here?

[shepilov]

Go way to support a specific symbol in URLs, and to avoid string concat like scheme + "://" + host

[shepilov]

Looks like tryUpdateMemberInstance(err, m, opts) is called only if the error status is 410 Gone while we update opts.Domain if the error status is 401 Unauthorized. Should we change the condition on line (newly) 666?

Sorry, didn't get your question. Why do we need to change this condition?