M1/F1: Kimi Code OAuth device-code flow

Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
  against kigi_env::oauth_host(); client_id per PRD; retryable statuses
  429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
  ~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
  (macOS/Windows native backends), atomic-file fallback under ~/.kigi;
  official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
  401-tombstone keyed by rejected refresh token with 300s cooldown and
  rotation auto-clear, cross-process lock with sibling-adoption
  triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
  external auth provider, JWT tier gating + subscription paywall stack,
  X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
  now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
  auth.kimi.com/api/oauth/device_authorization matches the wire shapes

Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.

crates/codegen/kigi-shell/src/auth/mod.rs

@@ -1,42 +1,30 @@
 pub(crate) mod attribution;
 mod config;
 pub mod credential_provider;
-#[path = "devbox_login_stub.rs"]
-pub(crate) mod devbox_login;
+pub(crate) mod device;
 pub mod device_code;
 pub mod error;
-mod external_auth;
 mod flow;
-mod jwt;
+pub(crate) mod kimi_oauth;
 pub(crate) mod manager;
 mod model;
-pub mod oidc;
 pub(crate) mod recovery;
 pub(crate) mod refresh;
 mod storage;
 pub(crate) mod token_type;
-pub(crate) use config::LEGACY_AUTH_SCOPE;
-pub use config::{
-    ForceLoginTeam, GrokComConfig, OAuth2ProviderConfig, OidcAuthConfig, PreferredAuthMethod,
-    XAI_OAUTH2_ISSUER, is_xai_oauth2_issuer, xai_oauth2_issuer,
-};
-pub(crate) use external_auth::{parse_output, refresh_with_command};
-pub(crate) use flow::{
-    AuthChannels, run_auth_flow, run_auth_flow_with_stderr_bridge,
-    try_ensure_session_noninteractive,
-};
+pub use config::{KIMI_CODE_OAUTH_SCOPE, KimiCodeConfig};
+pub(crate) use flow::try_ensure_session_noninteractive;
 pub use flow::{
-    AuthUrlInfo, AuthUrlMode, LoginTransportOverride, LogoutResult, ensure_authenticated,
-    ensure_authenticated_or_noninteractive, ensure_authenticated_with_override, perform_logout,
-    run_cli_login, run_cli_logout, try_ensure_fresh_auth,
+    AuthChannels, AuthUrlInfo, AuthUrlMode, LogoutResult, ensure_authenticated,
+    ensure_authenticated_or_noninteractive, perform_logout, run_auth_flow,
+    run_auth_flow_with_stderr_bridge, run_cli_login, run_cli_logout, try_ensure_fresh_auth,
 };
-pub use jwt::{is_jwt_expired_or_near, parse_jwt_expiration};
 mod meta;
 pub use error::{AuthError, RefreshTokenError, RefreshTokenFailedReason};
 pub use manager::{AuthManager, shared_api_key_provider};
 pub use meta::{AuthMeta, GateInfo};
-pub use model::{AuthMode, GrokAuth, lookup_auth};
-pub(crate) use model::{TOKEN_TTL, UserInfo, is_expired, token_suffix};
+pub use model::{AuthMode, KimiAuth, lookup_auth};
+pub(crate) use model::{TOKEN_TTL, is_expired, token_suffix};
 pub use storage::{
     clear_api_key, read_api_key, read_auth_json, read_token_by_scope, store_api_key,
 };