Kimi Code joins as an OAuth plan provider: RFC 8628 device flow, verified against the live endpoints

- New oauth/kimi-code-flow.ts mirrors the official kimi-cli: form-encoded device_authorization + token polling at auth.kimi.com with the required X-Msh-* device headers, pure poll interpreter, 15-minute tokens refreshed via refresh_token grant
- Agent loop runs chat completions at https://api.kimi.com/coding/v1 with the Bearer access token; default model kimi-for-coding (kimi-for-coding-highspeed for Allegretto+ plans)
- Live model listing via /coding/v1/models; credential refresh wired into the turn credential resolver
- Migration 057 seeds the provider (disabled) into existing organizations
- Wire protocol probed live: device code issued, authorization_pending poll observed, 401 envelope on the coding API confirmed

src/main/database/migrations/057-kimi-code-provider.ts

@@ -0,0 +1,8 @@
+export const kimiCodeProviderSchema = `
+  insert or ignore into providers(id, org_id, provider_key, label, auth_type, model, credential_id, enabled, created_at)
+  select 'prv_' || lower(hex(randomblob(16))), organizations.id, 'kimi-code', 'Kimi Code', 'oauth_pkce', 'kimi-for-coding', null, 0, datetime('now')
+  from organizations;
+
+  insert into schema_migrations(version, name, applied_at)
+  values (57, 'kimi_code_provider', datetime('now'));
+`;

src/main/database/schema.ts

@@ -55,6 +55,7 @@ import { autonomousPauseSchema } from "./migrations/053-autonomous-pause";
 import { closeStaleWakeTasksSchema } from "./migrations/054-close-stale-wake-tasks";
 import { taskOriginSchema } from "./migrations/055-task-origin";
 import { kimiProvidersSchema } from "./migrations/056-kimi-providers";
+import { kimiCodeProviderSchema } from "./migrations/057-kimi-code-provider";
 
 interface Migration {
   version: number;
@@ -119,6 +120,7 @@ const MIGRATIONS: Migration[] = [
   { version: 54, name: "close_stale_wake_tasks", sql: closeStaleWakeTasksSchema },
   { version: 55, name: "task_origin", sql: taskOriginSchema },
   { version: 56, name: "kimi_providers", sql: kimiProvidersSchema },
+  { version: 57, name: "kimi_code_provider", sql: kimiCodeProviderSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;