M1/F1: Kimi Code OAuth device-code flow

Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
  against kigi_env::oauth_host(); client_id per PRD; retryable statuses
  429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
  ~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
  (macOS/Windows native backends), atomic-file fallback under ~/.kigi;
  official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
  401-tombstone keyed by rejected refresh token with 300s cooldown and
  rotation auto-clear, cross-process lock with sibling-adoption
  triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
  external auth provider, JWT tier gating + subscription paywall stack,
  X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
  now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
  auth.kimi.com/api/oauth/device_authorization matches the wire shapes

Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.

crates/codegen/kigi-shell/src/mcp_doctor.rs

@@ -7,7 +7,7 @@ use std::sync::Arc;
 use kigi_tools::types::config_source::ConfigSource;
 use serde::Serialize;
 
-use crate::auth::GrokComConfig;
+use crate::auth::KimiCodeConfig;
 use crate::session::managed_mcp;
 use crate::session::mcp_servers;
 
@@ -272,13 +272,13 @@ fn managed_found(
 /// Discover managed `grok_com_*` servers if the user has xAI auth on disk.
 async fn try_discover_managed_servers() -> (ConfigSourceStatus, Vec<DiscoveredServer>) {
     let kigi_home = kigi_tools::util::kigi_home::kigi_home();
-    let grok_com_config = GrokComConfig::default();
-    let auth_manager = Arc::new(crate::auth::AuthManager::new(&kigi_home, grok_com_config));
+    let kimi_code_config = KimiCodeConfig::default();
+    let auth_manager = Arc::new(crate::auth::AuthManager::new(&kigi_home, kimi_code_config));
 
     let Some(snapshot) = auth_manager.current_or_expired() else {
         return managed_skipped("not logged in");
     };
-    if !snapshot.is_managed_mcp_eligible() {
+    if !snapshot.is_session_auth() {
         return managed_skipped(format!("{:?} auth (not xAI OIDC)", snapshot.auth_mode));
     }