refactor(extensions): simplify lib helpers, tool registration and kit-doctor

Behavior-preserving cleanups:
- extract shared resolveBaseUrl helper for jira/confluence base-URL logic
- extract shared registerTool helper; port jira/gitlab/confluence tools to it
- make scanSecrets declarative (filter/map)
- collapse ok/warn pair into status() and drop double existsSync in kit-doctor

Typecheck clean; npm test 71 PASS, 0 FAIL.

extensions/lib/atlassian.ts

@@ -36,6 +36,18 @@ function base(url: string): string {
 	return url.replace(/\/+$/, "");
 }
 
+/**
+ * Resolve an effective base URL from company.json + an env override.
+ * The env var wins when set (and not "TODO"); otherwise the config value
+ * (if set and not "TODO") is used. Trailing slashes are trimmed. Returns ""
+ * when neither is configured; callers decide whether to throw.
+ */
+export function resolveBaseUrl(envName: string, cfgValue: string | null | undefined): string {
+	const fromCfg = cfgValue && cfgValue !== "TODO" ? cfgValue : "";
+	const env = process.env[envName];
+	return (env && env !== "TODO" ? env : fromCfg).replace(/\/+$/, "");
+}
+
 /** Build a URL with query params; undefined/empty values are dropped. */
 export function buildUrl(
 	baseUrl: string,