Kimi Code joins as an OAuth plan provider: RFC 8628 device flow, verified against the live endpoints

- New oauth/kimi-code-flow.ts mirrors the official kimi-cli: form-encoded device_authorization + token polling at auth.kimi.com with the required X-Msh-* device headers, pure poll interpreter, 15-minute tokens refreshed via refresh_token grant
- Agent loop runs chat completions at https://api.kimi.com/coding/v1 with the Bearer access token; default model kimi-for-coding (kimi-for-coding-highspeed for Allegretto+ plans)
- Live model listing via /coding/v1/models; credential refresh wired into the turn credential resolver
- Migration 057 seeds the provider (disabled) into existing organizations
- Wire protocol probed live: device code issued, authorization_pending poll observed, 401 envelope on the coding API confirmed

src/main/services/provider-adapters.ts

@@ -24,6 +24,7 @@ import { backgroundUnsupported, retrieveUnsupported } from "./provider-backgroun
 import { authorizeWithParser, refreshUnsupported, revokeLocalProfile } from "./provider-auth-lifecycle";
 import { getJson, postEventStream, postJson, type JsonRecord } from "./provider-http";
 import { fetchAnthropicModels, fetchOpenAiModels } from "./provider-models-fetch";
+import { KIMI_CODE_BASE_URL } from "./oauth/kimi-code-flow";
 
 const ANTHROPIC_VERSION = "2023-06-01";
 const CLAUDE_PRO_BETA = "claude-code-20250219,oauth-2025-04-20,fine-grained-tool-streaming-2025-05-14";
@@ -233,6 +234,12 @@ export const providerAdapters: ProviderAdapterRegistry = {
       "anthropic-beta": CLAUDE_PRO_BETA,
     }),
   },
+  "kimi-code": {
+    ...browserTokenAdapter("kimi-code", PROVIDER_AUTH_TYPE.OAUTH_PKCE),
+    listModels: (ctx) => fetchOpenAiModels(`${KIMI_CODE_BASE_URL}/models`, {
+      authorization: `Bearer ${requireAccessTokenProfile(ctx.authProfile).accessToken}`,
+    }),
+  },
   "azure-openai": {
     providerKey: "azure-openai",
     authType: PROVIDER_AUTH_TYPE.CLOUD,