refactor: extract shared utilities for duplicated provider logic

[devin-ai-integration]

Summary

Behavior-preserving de-duplication of the clone groups a jscpd scan (167 exact clones, ~3k duplicated lines over app/) flagged as literal copies, plus the JSX Input variants. Net -730 lines, no behavior change: full rspec is identical to main on this box (793 examples, same 3 pre-existing env failures: unbuilt sprockets asset x2 + the node suite wrapper), npm test 88/88, eslint 0 errors, npm run build clean.

Five extractions:

• SpellSlots (app/lib/spell_slots.rb) — the level→slots tables were copy-pasted 12+ times across decorators/ and decorators_v2/. Only tables that were byte-identical collapsed into FULL_CASTER / HALF_CASTER / THIRD_CASTER / WARLOCK; the dnd5 paladin/ranger and dnd2024 ranger tables differ at low levels and were deliberately left inline. Long cross-class references (::Dnd5Character::ClassDecorateWrapper::SPELL_SLOTS) now read SpellSlots::FULL_CASTER.
• Dnd2024::Subclasses::ThirdCasterDecorator — ArcaneTricksterDecorator and EldritchKnightDecorator were identical apart from one string, so each is now class X < ThirdCasterDecorator; def spellcasting_class = 'rogue'; end.
• CharactersContext::{AvatarAttaching, CoinsSyncing, CharacterOptions, ClassSpellFeats} — the three provider UpdateCommands each carried the same upload_avatar, the same money⇄coins divmod block, the same skill/armor/damage-type enums, and (dnd2024/tlc) the same class-spell attach/detach. The spell module keeps the provider deltas as hooks so TLC's union scope is not narrowed:

  # dnd2024                     # tlc
  spell_feats_scope  = ::Dnd2024::Feat        ::Feat.tlc_content
  homebrew_feat_types = 'Dnd2024::Feat'       %w[Dnd2024::Feat Tlc::Feat]

  dnd5 keeps its own refresh_spells (it attaches Dnd5::Spell rows, not feats).
• CharactersContext::FeatFiltering — dnd2024 and tlc RefreshFeats were identical except REQUIRED_ATTRIBUTES and the content scope; the module holds the D&D 2024 gating as the default and dnd5 overrides the three predicates that read its older feat shape (selected_feats array condition, no species origin). Each class still declares its own REQUIRED_ATTRIBUTES (tlc's type for STI) and feats.
• ItemSerializing — Campaigns::ItemSerializer and Characters::ItemSerializer shared every method body; both now just declare their own ATTRIBUTES list (character adds state/charges) plus charges_max.

Also folded each Input.jsx's <Switch> over three near-identical <input> copies into one element with a derived type, keeping the numeric pattern/inputmode attributes conditional.

Deliberately not touched: the CharKeeperApp vs HomebrewsApp atom pairs (Input, Select, Label, …) are structurally similar but carry different styling contracts, so sharing them is a UI decision under DESIGN.md rather than a mechanical dedupe.

Link to Devin session: https://app.devin.ai/sessions/cd94a4134a654b11ae74d4ec784f9232
Requested by: @zacgoodwin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring