fix(session): real getMyProfiles shape {myprofiles:[...]} + active-profile detection [#767]

https://projects.knownelement.com/issues/767#note-4191

README.md

@@ -126,6 +126,9 @@ Flags may appear before or after positionals (`mglpi change show 104
 | environment | `MGLPI_URL`, `MGLPI_APP_TOKEN`, `MGLPI_USER_TOKEN`, `MGLPI_PROFILE_ID` (optional) | env wins over file |
 | `--config PATH` (also `$MGLPI_CONFIG`, default `~/.config/mglpi/env`) | same keys | file must be 0600 or stricter; refused before any read; parsed in pure Go (no sourcing/expansion) |
 
+`MGLPI_URL` is the FULL API base INCLUDING `/apirest.php` — e.g.
+`https://cmdb.knownelement.com/apirest.php`, not just the server host.
+
 Tokens travel only in headers: `App-Token` on every request,
 `Authorization: user_token ...` on initSession, `Session-Token` after.
 Response bodies are never surfaced in error strings — the fake GLPI