docs(flows): route an http node's credential by shape (#20682)

[objectstack-fleet]

Fixes #20682

Clause-②: no

Docs-only, content/docs/automation/flows.mdx, two spots.

1. The http node callout no longer sends every credential to a declarative connector's auth.credentialRef. It routes by shape: a header credential to bearer/basic/api-key; a query key to api-key with paramName; a secret in the url path has no credentialRef variant, so it goes to a token-authenticated connector such as slack, whose bot token is supplied by host code (the Slack connector is plugin-registered, not a declarative connectors: provider; only rest, openapi, mcp register providers). The first sentence and the signingSecret / start-node secret sentence are unchanged.
2. The retired-shapes row for actionType: 'slack' keeps the connector_action + Slack connector and drops the incoming-webhook http alternative.

Wording is in step with #20672's http descriptor and #20698's describes.

Acceptance notes

• pnpm --filter @objectstack/spec run check:skill-examples (client dist not built) and check:gitlink-declared were not run: NOT MEASURED. The other derived gates ran green (33 of 40 derived; the rest are checker self-tests), doc-security-posture and docs-spec-enumerations included.
• No changeset: docs-only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv