fix(infra): teardown reads the provisioner's state-directory precedence

provision.sh persists its recovery records under LATITUDE_STATE_DIR, else
$XDG_CONFIG_HOME/latitude, else ~/.config/latitude, but teardown hardcoded
the home path. A server provisioned with an alternate state location was
invisible to a no-argument teardown, which exited before its delete and
left the hourly-billed host running. Resolve the state directory (and the
LATITUDE_API_KEY_FILE override) exactly like provision.sh, and exercise
both alternate locations end-to-end against a stubbed provider.

Co-authored-by: Cursor <cursoragent@cursor.com>