feat: secure bearer gateway overrides (1/2 — merge first)

[niieani]

Bearer clients currently hardcode the Atlassian gateway. This change allows JIRA_GATEWAY_BASE_URL / CFL_GATEWAY_BASE_URL, falling back to ATLASSIAN_GATEWAY_BASE_URL, for controlled gateways and local tests. Commands resolve these values and inject them into clients, so construction no longer depends on ambient environment variables. HTTPS and loopback HTTP are accepted; other cleartext endpoints are rejected before sending a bearer token.

Merge order: 1 of 2 — merge this PR first. The dependent proxy-auth PR #502 builds on the shared URL validator and unified Confluence client constructor introduced here. After this PR merges, rebase #502 onto upstream main so its diff contains only proxy auth before merging it.

Second PR: #502

This replaces the gateway portion of #411 with a smaller review scope. Existing basic/bearer defaults and compatibility constructors are retained.

Validation: make check passed on this branch (module tidy, lint, race tests for all three modules, and both CLI builds). Tests cover gateway precedence, explicit injection, independence from ambient environment variables, and rejection of remote HTTP.

[niieani]

@piekstra-dev please review this PR first (1/2). This is the isolated gateway portion of #411, rebased onto current upstream and verified with make check. The dependent proxy auth is in #502 and should merge second.