fix(alibaba): anchor token-plan host suffix and apply ruff format

Anchor the maas.aliyuncs.com suffix check on a leading dot so spoofed
hosts (e.g. evilmaas.aliyuncs.com) no longer match the token-plan
quota-skip path, resolving the CodeQL py/incomplete-url-substring-
sanitization alert. Also wrap the long ALIBABA_TOKEN_PLAN_BASE_URL
literal to satisfy ruff format.

Author: elkaix

src/pythinker_code/auth/alibaba.py

@@ -21,7 +21,9 @@
 ALIBABA_BASE_URL = "https://dashscope-us.aliyuncs.com/compatible-mode/v1"
 ALIBABA_CHINA_BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1"
 # Shared international (Team Edition) Token Plan endpoint — the default for plan keys.
-ALIBABA_TOKEN_PLAN_BASE_URL = "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1"
+ALIBABA_TOKEN_PLAN_BASE_URL = (
+    "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1"
+)
 ALIBABA_PROVIDER_KEY = managed_provider_key(ALIBABA_PLATFORM_ID)
 ALIBABA_DEFAULT_MODEL_ALIAS = f"{ALIBABA_PLATFORM_ID}/qwen3.7-plus"
 ALIBABA_DEFAULT_CONTEXT = 131_072

src/pythinker_code/ui/shell/usage_adapters/alibaba.py

@@ -53,7 +53,7 @@ def _endpoint_without_quota_api(base_url: str) -> bool:
     host = urlparse(base_url).netloc
     if host.startswith("coding") and "dashscope" in host:
         return True
-    return host.startswith("token-plan") and host.endswith("maas.aliyuncs.com")
+    return host.startswith("token-plan") and host.endswith(".maas.aliyuncs.com")
 
 
 def _parse_quota_response(data: object) -> list[UsageRow]: