refactor(core): move provider HTTP owners into services

[limityan]

Summary

• Move concrete HTTP ownership for browser CDP endpoints, WebFetch/WebSearch Exa calls, debug-log ingest posting, and review-platform provider transport into bitfun-services-integrations.
• Keep bitfun-core as compatibility/product semantics facade for these paths; tool result envelopes, review DTO mapping, pagination policy, and product orchestration remain unchanged.
• Add explicit feature gates and boundary rules to prevent concrete HTTP ownership from drifting back into core, and sync the migration plan/completed docs.

Risk / compatibility

• No intended tool schema, event, permission, review-platform DTO, or product-shape change.
• New service-facing APIs avoid exposing reqwest error/status types to upper layers.
• bitfun-core --no-default-features remains buildable; product-full continues to assemble the full provider set.

Refs #970

Verification

• node scripts/check-core-boundaries.mjs
• node --test scripts/check-core-boundaries.test.mjs
• cargo test -p bitfun-services-integrations --features browser-control,web-tools,debug-log,review-platform --lib
• cargo check -p bitfun-core --no-default-features
• cargo check -p bitfun-core --features product-full
• cargo test -p bitfun-core --features product-full review_platform
• pnpm run check:repo-hygiene
• git diff --check
• cargo metadata --no-deps --format-version 1

Note: cargo check/test --features product-full still reports existing rmcp deprecated-method warnings in mcp/protocol/client_info.rs.