fix(jira): name the credential that failed instead of returning a bare 401

A personal access token silently outranked Basic credentials. Anything left in
pat — an email pasted into the wrong field, a token from a decommissioned Data
Center — became the Authorization header, and Atlassian answered "Client must
be authenticated to access this resource." That sentence names no field, so the
search starts at the URL, the API version, the token itself: everywhere except
the one field that caused it.

Basic authentication now wins whenever username and api_key are both set, and
pat serves the rest, so a token left behind cannot outrank credentials someone
has just filled in. A lone username, or a lone api_key, is not a pair and does
not claim the request. A 401 or 403 says which method was used and whether the
other was configured and ignored.

Three configurations that cannot work are refused with the reason rather than
sent to Jira:

  - no usable credential, where an empty username/api_key pair was being
    base64-encoded into a valid-looking header;
  - the Cloud gateway URL with an empty cloud_id, which addresses no site, so
    every path under it is a dead link and Jira replies with an HTML 404 that
    explains nothing;
  - a cloud_id set against any other host, where it is not an address at all,
    only a path segment that does not exist.

Credentials are stripped before use: one pasted with a trailing newline
corrupts the header and reads back as a wrong password.

Error bodies are condensed instead of dumped. Jira's 404 page is four hundred
lines of AUI markup, stylesheet links and inline scripts around one sentence,
and it was going into the test modal whole; what surfaces now is the <title>
and the readable text, capped. A 2xx that is not JSON — a login page, an SSO
redirect, a proxy standing in for the API — reports what answered and the URL
the redirects landed on, in place of a JSON parser offset.

Config descriptions now say which fields pair with which deployment, and which
credential is used when both are present.

Applied to all 27 scripts; the seven shared helper blocks stay identical across
them.

integrations/jira/manifest.yaml

@@ -1,8 +1,8 @@
 id: jira
 name: Jira
-version: 1.0.0
+version: 1.0.1
 description: "Atlassian Jira (REST API, Cloud and On-Prem/Data Center) — issue lifecycle (create/read/edit/delete, transitions, assign), comments, web + issue links, attachments (upload/download/delete), field and user lookups, agile boards/sprints/epics, plus issue ingestion (get_incidents) with an OCSF mapper. Basic (email + API token) or Personal Access Token authentication. Stdlib-only, no extra Python dependencies."
-changelog: "1.0.0 — Initial release: JQL ingestion + query, full issue CRUD and transitions, comments, links, attachments, fields/users, and agile board/sprint/epic listing. Cloud (API v3, ADF bodies) and On-Prem (API v2) supported."
+changelog: "1.0.1 — A personal access token silently outranked Basic credentials, so an unusable value left in pat turned every call into an opaque 401. Basic authentication now wins whenever username and api_key are both set, pat serves the rest, and a 401/403 names the method it used and whether the other was configured and ignored. Three configurations that cannot work are refused with the reason instead of being sent to Jira: no usable credential, the Cloud gateway URL without a cloud_id, and a cloud_id set against any other host. HTML error pages are condensed to their message rather than dumped whole, and a non-JSON body reports what answered and where. 1.0.0 — Initial release: JQL ingestion + query, full issue CRUD and transitions, comments, links, attachments, fields/users, and agile board/sprint/epic listing. Cloud (API v3, ADF bodies) and On-Prem (API v2) supported."
 category: ticketing
 
 # Per-instance configuration. For Jira Cloud set cloud_id (found at
@@ -14,21 +14,21 @@ config_schema:
   properties:
     server_url:
       type: string
-      description: "Base URL. Jira Cloud: https://api.atlassian.com/ex/jira (default). On-Prem: your Jira server URL."
+      description: "Base URL. Jira Cloud: keep the default and set cloud_id. On-Prem/Data Center: your own Jira URL, e.g. https://jira.example.com, with cloud_id left empty."
       default: https://api.atlassian.com/ex/jira
     cloud_id:
       type: string
-      description: "Jira Cloud ID (leave empty for On-Prem/Data Center)"
+      description: "Jira Cloud ID, found at admin.atlassian.com/s/<cloud_id>/users. Required alongside the Cloud gateway URL; leave empty for On-Prem/Data Center."
     username:
       type: string
-      description: "Account email (Basic auth)"
+      description: "Account email (Basic auth, Jira Cloud). Pairs with api_key: both must be set for Basic authentication to be used."
     api_key:
       type: string
-      description: "API token (Basic auth)"
+      description: "API token (Basic auth, Jira Cloud). Created at id.atlassian.com/manage-profile/security/api-tokens. Pairs with username."
       x-soar-sensitive: true
     pat:
       type: string
-      description: "Personal Access Token (use instead of username/api_key)"
+      description: "Personal Access Token (On-Prem/Data Center only). Used when username and api_key are not both set. Leave empty on Cloud."
       x-soar-sensitive: true
   required:
     - server_url