M1/F1: Kimi Code OAuth device-code flow

Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
  against kigi_env::oauth_host(); client_id per PRD; retryable statuses
  429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
  ~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
  (macOS/Windows native backends), atomic-file fallback under ~/.kigi;
  official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
  401-tombstone keyed by rejected refresh token with 300s cooldown and
  rotation auto-clear, cross-process lock with sibling-adoption
  triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
  external auth provider, JWT tier gating + subscription paywall stack,
  X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
  now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
  auth.kimi.com/api/oauth/device_authorization matches the wire shapes

Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.

crates/codegen/kigi-workspace/src/hub_auth.rs

@@ -300,7 +300,7 @@ mod tests {
             "scope": {
                 "key": "eyJhbGciOiJFUzI1NiJ9.tok",
                 "user_id": "u1",
-                "auth_mode": "oidc",
+                "auth_mode": "oauth",
                 "create_time": "2026-01-01T00:00:00Z",
                 "email": "test@x.ai",
                 "first_name": "Test",

crates/codegen/kigi-workspace/src/session/tool_config.rs

@@ -500,13 +500,6 @@ fn build_proxy_headers(base_url: &str) -> indexmap::IndexMap<String, String> {
         format!("kigi-workspace/{version}"),
     );
     headers.insert("x-grok-client-version".to_string(), version.to_string());
-    if base_url.contains("cli-chat-proxy") || base_url.contains("chat-proxy") {
-        headers.insert("X-XAI-Token-Auth".to_string(), "xai-grok-cli".to_string());
-        headers.insert(
-            "x-authenticateresponse".to_string(),
-            "authenticate-response".to_string(),
-        );
-    }
     headers
 }
 /// Build web fetch config. Enabled with default params unless