Harden provider-specific authentication boundaries across Mural, GitLab, and Jira

Track and validate the provider-specific authentication and destination controls that extend beyond the shared Jira/GitLab transport remediation and the Jira/GitLab redaction architecture.

The scope covers Mural API and SAS destination integrity, GitLab public-client OAuth and credential lifecycle, and Jira scoped Cloud-token routing and audit privacy.

## Acceptance Criteria

- [ ] Mural accepts the canonical production API destination and only an explicitly enabled loopback development destination.
- [ ] Mural token, API, and SAS-upload requests use separate no-redirect openers, finite timeouts, and tests proving that Mural bearer credentials are never forwarded to the SAS destination.
- [ ] GitLab uses public-client Authorization Code with PKCE by default and provides a bounded device-authorization flow for browserless environments.
- [ ] GitLab PAT authentication is available only through an explicit legacy-token mode, and mixed OAuth/PAT configuration fails closed.
- [ ] GitLab OAuth profiles are bound to the instance and client ID and use owner-only, symlink-resistant, atomic persistence with process and cross-process locking.
- [ ] GitLab refresh rotation preserves retryability for conclusively pre-exchange failures and requires re-login after completion-uncertain failures.
- [ ] GitLab loopback callbacks validate the exact host, path, state, and deadline without exposing codes, tokens, or profile data.
- [ ] Jira scoped Cloud tokens route only through the fixed Atlassian resource origin using a validated single-segment Cloud ID.
- [ ] Jira Data Center PAT, unscoped Cloud, and scoped Cloud configurations are mutually isolated, and audit records exclude Cloud IDs, request paths, queries, and credentials.
- [ ] Authentication, destination, refresh, callback, profile-store, and audit-privacy behavior is covered by regression and fuzz tests and reflected in the Mural, GitLab, and Jira security models.

## Scope

- Mural API, token, and Azure SAS egress controls.
- GitLab OAuth, explicit legacy PAT mode, credential persistence, callback handling, refresh rotation, and audit privacy.
- Jira scoped Cloud routing, authentication-mode isolation, Cloud-ID validation, and audit privacy.
- Provider-specific tests and security-model updates.

## Non-goals

- Reimplementing the shared Jira/GitLab HTTP transport controls tracked in #2227 and #2228.
- Replacing the redaction architecture tracked in #1556 and #1557 or its test-gating follow-up in #1559.
- Provider-side token revocation, certificate pinning, signed audit logs, SBOM publication, or defense against same-user malware.

## Related

- Shared GitLab transport baseline: #2227.
- Shared Jira transport baseline: #2228.
- Jira and GitLab redaction architecture: #1556 and #1557.
- Redaction test gating: #1559.