feat(toolkit-core): Share the API transport with the CLI

Move the CLI's request loop from sentry-client.ts into
@sentry/toolkit-core/api-transport: the Authorization header, the 401
refresh (any method, once), per-attempt timeouts, retries through
api-retry, request-body replay, validated redirect following with
origin provenance, and GET cache lookup, revalidation, storage, and
post-write invalidation. The host injects a CredentialProvider, header
rules, a cache, its error classes, a logger, and a span hook, so the
module stays free of Node APIs.

The CLI now configures the transport with its stored credentials,
host-scope checks, disk cache, telemetry span, and error classes.

Implements #1669 tasks 5.1 and 5.2.

Co-Authored-By: BYK <burak.kaya@sentry.io>

Author: sentry-junior[bot]

docs/contributing/api-patterns.md

@@ -294,11 +294,12 @@ Retries are:
 Callers and tools need no changes: a retried request either resolves normally or
 throws the same error it would have thrown without retries.
 
-The CLI's transport (`packages/cli/src/lib/sentry-client.ts`) follows the same
-shared rule. Only the caps differ (`RETRY_POLICY`): the hosted MCP keeps its
-total wait short so a Workers request isn't held open, while the CLI can wait
-longer. The CLI also applies its own per-request timeout, which counts as a
-network failure.
+The CLI sends its requests through the shared transport in
+`@sentry/toolkit-core/api-transport`, configured in
+`packages/cli/src/lib/sentry-client.ts`. It follows the same shared rule; only
+the caps differ (`RETRY_POLICY`): the hosted MCP keeps its total wait short so
+a Workers request isn't held open, while the CLI can wait longer. The CLI also
+applies its own per-request timeout, which counts as a network failure.
 
 ## Best Practices
 

packages/cli/src/lib/fetch-input.ts

@@ -1,19 +1,6 @@
 /**
- * Helpers for the `input` argument of `fetch()`.
+ * Helpers for the `input` argument of `fetch()`. The transport owns the
+ * implementation; this path stays for CLI callers and tests.
  */
 
-/**
- * Extract the full URL string from a fetch input.
- *
- * `String(request)` yields `"[object Request]"`, so `Request` inputs need
- * their `.url` read explicitly.
- */
-export function extractInputUrl(input: Request | string | URL): string {
-  if (typeof input === "string") {
-    return input;
-  }
-  if (input instanceof URL) {
-    return input.href;
-  }
-  return input.url;
-}
+export { extractInputUrl } from "@sentry/toolkit-core/api-transport";