[adamtheturtle]

Shared endpoint builders still hardcode the Vuforia service URLs even though shared SDK clients now consume backend URL fixtures. Pass base_vws_url or base_vwq_url into all eleven prepared endpoint fixtures. Update the missing Authorization/Date header assertions to identify the query API by its configured URL, so those tests work when the services share a hostname and use different ports.

This three-file follow-up to #3745 advances #3738, part of #3737. Further URL and backend decoupling remains in #3738.

Validation:

• Python 3.15: all 44 targeted missing-header cases pass across the in-memory and Flask backends, using synthetic credentials with retries disabled. Twenty-two real-Vuforia cases are skipped locally.
• Reused the same tests from a separate consumer harness with MockVWS configured at http://127.0.0.1:5006 and http://127.0.0.1:5007: all 22 endpoint/header cases pass. The three changed files have 100% statement and branch coverage across the targeted runs.
• Pre-commit and pre-push hooks pass, including CI partition validation, Mypy, Pyright, public type completeness, Ty, and Pyrefly. Pylint passes for all changed files, and git diff --check passes.

Full-suite coverage and real-Vuforia validation remain for hosted CI.