Kimi Code joins as an OAuth plan provider: RFC 8628 device flow, verified against the live endpoints

- New oauth/kimi-code-flow.ts mirrors the official kimi-cli: form-encoded device_authorization + token polling at auth.kimi.com with the required X-Msh-* device headers, pure poll interpreter, 15-minute tokens refreshed via refresh_token grant
- Agent loop runs chat completions at https://api.kimi.com/coding/v1 with the Bearer access token; default model kimi-for-coding (kimi-for-coding-highspeed for Allegretto+ plans)
- Live model listing via /coding/v1/models; credential refresh wired into the turn credential resolver
- Migration 057 seeds the provider (disabled) into existing organizations
- Wire protocol probed live: device code issued, authorization_pending poll observed, 401 envelope on the coding API confirmed

src/main/services/oauth/oauth-flows.ts

@@ -2,6 +2,7 @@ import { githubCopilotFlow } from "./github-copilot-flow";
 import { openaiCodexFlow } from "./openai-codex-flow";
 import { antigravityFlow } from "./google-antigravity-flow";
 import { anthropicClaudeFlow } from "./anthropic-claude-flow";
+import { kimiCodeFlow } from "./kimi-code-flow";
 import type { OAuthFlow } from "./oauth-types";
 
 /** Provider keys (from the catalog) mapped to their native OAuth login flow. */
@@ -10,6 +11,7 @@ const OAUTH_FLOWS: Record<string, OAuthFlow> = {
   "gpt-account": openaiCodexFlow,
   "google-antigravity": antigravityFlow,
   "claude-pro": anthropicClaudeFlow,
+  "kimi-code": kimiCodeFlow,
 };
 
 export function hasOAuthFlow(providerKey: string): boolean {