Problem

Anvil is no longer an on-prem offering — https://anvil.fangorn.io is the server in ~99% of invocations. But the CLI treats server_url as an unknown that must be discovered via anvil auth login, and Config::server_url() returns ConfigError::NotLoggedIn when it is unset (src/config.rs:83-85).

Two consequences:

1. Commands that need no credentials fail anyway. anvil update hits /runner/version, /runner/download, and /runner/checksums — all plain reqwest::get, no auth header (src/commands/update.rs:27,129,141). It needs only a server URL. But it opens with config.server_url()? (update.rs:24), so on a host with no user config it dies with:

$ /home/pi/.local/bin/anvil update
Error: not logged in — run `anvil auth login` first

This reproduces on every runner host. A runner is provisioned by dropping a runner config at --config ~/.anvil-runner/config.json (src/runner/config.rs:5-27); nothing ever writes the user config at ~/.config/anvil/config.json that Config::load() reads (src/config.rs:28-38). The runner polls jobs happily while anvil update — the one command such a host actually needs — is unreachable. Self-update on runners is currently broken by construction.

2. The error is wrong on its face. Logging in cannot be the fix for a command that sends no token. NotLoggedIn is doing double duty as “no server URL configured”, which is also the root of #33.

Fix

Bake the production URL in as the default and let credentials be the only thing login provides.

• Add DEFAULT_SERVER_URL = \"https://anvil.fangorn.io\" in src/config.rs.
• Make Config::server_url() infallible (-> &str), falling back to the default. token() keeps returning NotLoggedIn — that stays the real auth gate.
• Resolution order, unchanged in spirit: ANVIL_SERVER_URL env > config file > baked-in default. Staging and local installs keep working through the env var, which is already how the test suite points the binary at wiremock.
• Update the call sites that read the bare Option to print web links (pr.rs:720, repo.rs:236, issue.rs:494, release.rs:406) so they resolve the default instead of silently skipping the link.
• auth status: base logged_in on token presence alone, and report the resolved server (auth.rs:317).

Acceptance criteria

• anvil update and anvil update --check succeed against production with no config file and no env vars set.
• ANVIL_SERVER_URL still overrides the default; a server_url in the config file still overrides the default.
• Commands requiring credentials still fail with not logged in when no token is present — the message is not weakened for genuinely unauthenticated calls.
• anvil auth status reports the resolved server URL and does not claim to be logged in on server URL alone.
• Tests cover the precedence chain (env > file > default) and the no-config update path.