M1/F1: Kimi Code OAuth device-code flow

Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
  against kigi_env::oauth_host(); client_id per PRD; retryable statuses
  429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
  ~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
  (macOS/Windows native backends), atomic-file fallback under ~/.kigi;
  official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
  401-tombstone keyed by rejected refresh token with 300s cooldown and
  rotation auto-clear, cross-process lock with sibling-adoption
  triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
  external auth provider, JWT tier gating + subscription paywall stack,
  X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
  now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
  auth.kimi.com/api/oauth/device_authorization matches the wire shapes

Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.

crates/codegen/kigi-shell/src/session/feedback_manager.rs

@@ -981,23 +981,23 @@ mod tests {
     async fn test_is_auth_permanently_failed_reads_auth_manager() {
         use crate::agent::feedback_client::FeedbackClient;
         use crate::auth::error::RefreshTokenFailedReason;
-        use crate::auth::{AuthManager, GrokAuth, GrokComConfig};
+        use crate::auth::{AuthManager, KimiAuth, KimiCodeConfig};
         use std::sync::Arc;
 
         let dir = tempfile::tempdir().unwrap();
-        let am = Arc::new(AuthManager::new(dir.path(), GrokComConfig::default()));
+        let am = Arc::new(AuthManager::new(dir.path(), KimiCodeConfig::default()));
         let client = FeedbackClient::new("http://example/v1", None).with_auth_manager(am.clone());
 
         assert!(!client.is_auth_permanently_failed());
 
-        // The verdict is scoped to the live credential's key.
-        am.hot_swap(GrokAuth {
+        // The tombstone is scoped to the live credential's refresh token.
+        am.hot_swap(KimiAuth {
             key: "tok".into(),
-            ..GrokAuth::test_default()
+            refresh_token: Some("rt".into()),
+            expires_at: Some(chrono::Utc::now() - chrono::Duration::hours(1)),
+            ..KimiAuth::test_default()
         });
-        // Use a non-sticky reason: only recoverable verdicts age out (a sticky
-        // `RefreshTokenRejected` never expires), and this exercises the TTL path.
-        am.record_permanent_failure("tok".to_string(), RefreshTokenFailedReason::Other.into());
+        am.record_permanent_failure("rt".to_string(), RefreshTokenFailedReason::Other.into());
         assert!(client.is_auth_permanently_failed());
 
         am.force_permanent_failure_aged_out();
@@ -1018,7 +1018,7 @@ mod tests {
     #[tokio::test]
     async fn test_has_token_refresher_requires_refresher_attached() {
         use crate::agent::feedback_client::FeedbackClient;
-        use crate::auth::{AuthManager, GrokComConfig};
+        use crate::auth::{AuthManager, KimiCodeConfig};
         use std::sync::Arc;
 
         struct NoOpRefresher;
@@ -1035,7 +1035,7 @@ mod tests {
         }
 
         let dir = tempfile::tempdir().unwrap();
-        let am = Arc::new(AuthManager::new(dir.path(), GrokComConfig::default()));
+        let am = Arc::new(AuthManager::new(dir.path(), KimiCodeConfig::default()));
 
         let bare = FeedbackClient::new("http://example/v1", None);
         assert!(!bare.has_token_refresher());