Register and check an Atlassian account

[artyomsv]

Goal

An Atlassian site (Jira, Confluence) can be registered as an account, so a context source can
point at it instead of holding its own token.

Changes

spire-orchestrator/.../provider/ProviderResource.java

TYPES (:52) widens past ProviderClients.SUPPORTED_TYPES to admit atlassian. The two lists
stop being the same list, on purpose: an Atlassian account is a credential holder, not an SCM the
pipeline can review on.

spire-orchestrator/.../provider/ProviderClients.java

The registration and Check probe dispatches by kind, inside ProviderClients.

This is a composition root, which is the one place ADR-020 permits a provider-name decision.
Anywhere else and the spire-arch provider-neutrality scan objects — correctly.

Probes, reusing what the adapters already call:

Kind	Probe
github	GET /user
gitlab	GET /user
bitbucket-cloud	GET /2.0/user, falling back to GET /repositories/{ws}
atlassian	GET /rest/api/3/myself (Jira) or /wiki/rest/api/user/current (Confluence)

The form

An Atlassian account has no forge role:

• role = 'CONTEXT', workspace = NULL.
• The Role field is hidden when the kind is atlassian.
• PUT /api/providers/{id} still refuses a role change with 409 — that rule is unchanged
  (PR Separate accounts from repositories, and give an account a role #120).

Known limits, to write into docs/UNVERIFIED.md

• Today's Jira and Confluence adapters call {baseUrl}/rest/api/2/... on the site host
  (JiraContextProvider.java:95). Scoped Atlassian API tokens are honoured only at
  https://api.atlassian.com/ex/jira/{cloudId}. Whether the adapters work at all with a scoped token
  is unmeasured. Classic tokens on the site host are what works today.
• Atlassian classic tokens have no scopes at all — the authority is the user's. New ones expire
  after one year by default (since 2024-12-15).

Acceptance

• An Atlassian account registers with a base URL, basic auth (email + API token) and no role
  field shown.
• It is stored with role = 'CONTEXT' and workspace = NULL.
• Check probes the Atlassian endpoint and records last_check_ok / last_check_error.
• A bad token records a failed check and does not delete or disable the row.
• Two Atlassian accounts on one site both register.
• spire-arch's provider-neutrality check passes — the kind dispatch lives only in
  ProviderClients. Mutation-verify: move one arm into a core class, the arch test must fail.
• docs/UNVERIFIED.md gains the two limits above.
• ./gradlew testFast green.

---

Part of #148