[nycomp]

Refs #982 (parent: #970, phase 3 prep). Coordination plan agreed on #982: copy-before-delete — this PR lands the new location with a compatibility shim; the SDK flip (campus-api-python) and the shim deletion follow as separate steps so CI and the weekly Railway autodeploy stay green throughout.

What

Move HttpAuthProperty / HttpHeader / HttpHeaderWithAuth from campus/webauth/models/ to campus/model/http.py (the historical home), re-exported via campus.model — restoring the pre-extraction campus.model.HttpHeader API. These are stdlib-only pure data classes that the consumer layer (flask_campus) and the SDK (campus_python) both need; they belong in the data-model layer so the planned campus-flask distribution needs only common + model, never core.

• In-repo import sites switched directly: campus/flask_campus/utils.py, campus/webauth/http/__init__.py, tests/flask_test/campus_request.py, tests/flask_test/json_client.py.
• Tests moved: tests/unit/webauth/test_header.py → tests/unit/model/test_http.py.
• campus.webauth.models kept as a temporary shim re-exporting from campus.model. It exists solely for campus_python's json_client (import at campus_python/json_client/__init__.py:18), whose lock still resolves a campus-suite commit without the new path. Follow-up PR (after the SDK import flips to campus.model and campus's SDK lock advances): delete the shim + drop models from campus/webauth/__init__.py.
• Boundary contract unchanged and unmodified: model stays allowed-dep {common} (http.py is stdlib-only); webauth → model was already a declared edge (SHARED_ALLOWED).
• Docs: architecture.md header-models bullet moved from webauth → model section; flask_campus/README.md import paths updated.

Verification

• unit: 872 tests, OK (worktree venv)
• contract: all passed — this also proves the shim serves the SDK, since the contract fixtures import campus_python's json_client through campus.webauth.models
• ruff check .: green

Next (per #982 coordination plan)

1. campus-api-python: flip json_client import to campus.model + poetry update campus-suite in the same PR.
2. campus: delete the shim + advance campus's campus-api-python lock in the same PR (grep gate: zero webauth.models importers).
3. Downstream relocks (classroom / admin / profile-dev / cli): bump campus-suite + campus-api-python together, one lock-only PR each. No downstream code changes — none of them import these classes directly.