StoredSession now carries the host_url its grant was issued for. auth status prints the DID document's current PDS beside it and warns when they differ; --json gains session_pds and pds_moved. A refresh resolves the current PDS before spending the token and refuses with the move and the login that repairs it.
Reads that need no session already follow the DID document, so a move used to leave reads working and writes failing at the old host, silently. The check runs at the refresh — the one moment a network round trip is already being made — rather than on every command, which would put a PLC lookup in front of every invocation on a fleet. An unreachable DID document still lets the refresh proceed.
Verification: tests/auth_flows.rs covers the status warning, its JSON fields, and the refresh refusal with an expired session. Unit tests cover the URL comparison and the refresh window; clippy is clean.