refactor(apigateway): upstream authentication and transport policy move to a shared seam under internal/, so a second HTTP-based connection kind reuses them instead of copying them (#1647) - #1653