refactor(extensions): simplify lib helpers, tool registration and kit-doctor

Behavior-preserving cleanups:
- extract shared resolveBaseUrl helper for jira/confluence base-URL logic
- extract shared registerTool helper; port jira/gitlab/confluence tools to it
- make scanSecrets declarative (filter/map)
- collapse ok/warn pair into status() and drop double existsSync in kit-doctor

Typecheck clean; npm test 71 PASS, 0 FAIL.

extensions/lib/jira.ts

@@ -3,7 +3,7 @@
  * `trackerUrl` comes from config/company.json; `JIRA_TOKEN` from the env.
  * No pi API — unit-testable (see test/api.test.ts).
  */
-import { apiRequest, requireToken, ApiError } from "./atlassian.ts";
+import { apiRequest, requireToken, ApiError, resolveBaseUrl } from "./atlassian.ts";
 import { readLocalConfig } from "./company-config.ts";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -11,12 +11,11 @@ import { fileURLToPath } from "node:url";
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const CONFIG_PATH = path.join(HERE, "..", "..", "config", "company.json");
 
-/** Resolve the tracker base URL — prefer company.json; env override wins. */
+/** Resolve the tracker base URL — company.json default, env override wins. */
 export function jiraBaseUrl(): string {
 	const cfg = readLocalConfig(CONFIG_PATH);
-	const fromCfg = cfg.trackerUrl && cfg.trackerUrl !== "TODO" ? cfg.trackerUrl : "";
 	// env TRACKER_URL may override the packaged default for local labs.
-	return (process.env.TRACKER_URL && process.env.TRACKER_URL !== "TODO" ? process.env.TRACKER_URL : fromCfg).replace(/\/+$/, "");
+	return resolveBaseUrl("TRACKER_URL", cfg.trackerUrl);
 }
 
 function token(): string {