refactor(extensions): simplify lib helpers, tool registration and kit-doctor

Behavior-preserving cleanups:
- extract shared resolveBaseUrl helper for jira/confluence base-URL logic
- extract shared registerTool helper; port jira/gitlab/confluence tools to it
- make scanSecrets declarative (filter/map)
- collapse ok/warn pair into status() and drop double existsSync in kit-doctor

Typecheck clean; npm test 71 PASS, 0 FAIL.

extensions/lib/confluence.ts

@@ -3,7 +3,7 @@
  * `docsUrl` comes from config/company.json; `CONFLUENCE_TOKEN` from the env.
  * No pi API — unit-testable.
  */
-import { apiRequest, requireToken, ApiError } from "./atlassian.ts";
+import { apiRequest, requireToken, ApiError, resolveBaseUrl } from "./atlassian.ts";
 import { readLocalConfig } from "./company-config.ts";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -14,8 +14,7 @@ const CONFIG_PATH = path.join(HERE, "..", "..", "config", "company.json");
 /** Resolve the Confluence base URL from company.json (env override for labs). */
 export function confluenceBaseUrl(): string {
 	const cfg = readLocalConfig(CONFIG_PATH);
-	const fromCfg = cfg.docsUrl && cfg.docsUrl !== "TODO" ? cfg.docsUrl : "";
-	const url = (process.env.CONFLUENCE_URL && process.env.CONFLUENCE_URL !== "TODO" ? process.env.CONFLUENCE_URL : fromCfg).replace(/\/+$/, "");
+	const url = resolveBaseUrl("CONFLUENCE_URL", cfg.docsUrl);
 	if (!url) throw new ApiError("Не задан docsUrl в config/company.json и нет CONFLUENCE_URL.");
 	return url;
 }