ADR: extract shared @autobot/http-core — 3 fetch clients (main ApiClient / slm ApiClient / slmClient) share ~300-380 lines transport #12655

Owner/ADR decision surfaced by the Phase-2 migration. Three hand-written fetch clients share a near-identical transport core:

• autobot-frontend/src/utils/ApiClient.ts (842L, ~300 transport)
• autobot-slm-frontend/src/utils/ApiClient.ts (419L, ~380 transport — ~250-300 near-line-identical to main; its own docstring defers a shared core to 'a later ADR')
• autobot-frontend/src/utils/slmClient.ts (163L, from canonical(frontend): autobot-frontend has SLM-control-plane calls (getSLMUrl) with no dedicated client — need an SLM bridge analogous to slmApiClient #12614/feat(frontend): canonical SLM bridge for main-frontend getSLMUrl callers (#12614) #12644)

Shared: rawRequest (AbortController timeout + signal-forward + FormData + auth inject + 401 hook + base-URL join), get (retry+backoff, no-retry-4xx), post/put/patch/delete (204+content-type), extractErrorInfo, parseJsonBody, uploadFile (XHR progress — IDENTICAL between the two ApiClients).

Proposal: a createHttpClient(config) factory parameterized on the 5 axes that differ per app: baseUrl resolver, token source, 401 handler, auth-endpoint skip predicate, extra headers (X-Organization-Id main-only). Collapses ~300-380 lines.

Why an ADR (not execute-now): crosses the autobot-frontend ↔ autobot-slm-frontend package boundary (no @autobot/* workspace pkg exists yet — needs a shared-pkg/path-alias decision) and unifies security-sensitive 401/auth-storage behavior that currently differs per app on purpose. Recommend: land the bounded adapter de-dup first; do this after #12644 merges so all 3 clients exist to refactor together. Refs #12420, #12614.