refactor(auth): centralize inference-credential routing in CredentialAuthority

One authority answers 'which credential may ride this request':
credential_class / manager_for / credential_for / bearer_resolver_for,
keyed by (platform, base_url). SessionCredential is an opaque type with
no production constructor, so a new call site cannot re-introduce the
session-bearer leak. Platform-scoped tests extended across all bearer
channels (session, aux, summary, subagent override).

Verified: cargo check --workspace --all-targets clean; kigi-shell and
kigi-tui suites green (6611+ tests).

crates/codegen/kigi-shell/src/agent/subagent/mod.rs

@@ -1011,18 +1011,13 @@ fn resolve_model_override_to_config(
     // stamp onto the child's api.x.ai / api.moonshot.cn credentials. The
     // first-party subscription channel still resolves to the primary
     // (byte-identical).
-    let session_key = crate::auth::oauth_registry::session_key_for_endpoint(
-        entry
-            .info()
-            .id
-            .as_deref()
-            .and_then(kigi_models::parse_managed_model_key)
-            .map(|(platform, _)| platform),
-        &entry.info().base_url,
-        Some(&ctx.auth_manager),
-    );
+    let session_key = crate::auth::credential_authority::CredentialAuthority::new(
+        ctx.models_manager.endpoints(),
+        Some(ctx.auth_manager.clone()),
+    )
+    .credential_for_model(&entry);
     let has_session_key = session_key.is_some();
-    let mut credentials = resolve_credentials(&entry, session_key.as_deref());
+    let mut credentials = resolve_credentials(&entry, session_key.as_ref());
     credentials.auth_type = subagent_auth_type(Some(&entry), &ctx.auth_method_id);
     let resolved_auth_type = credentials.auth_type;
     let config = sampling_config_for_model(&entry, credentials, ctx.alpha_test_key.clone());

crates/codegen/kigi-shell/src/agent/subagent/tests/rest.rs

@@ -2545,8 +2545,9 @@ async fn subagent_override_first_party_model_still_gets_primary_token() {
 /// (`subagent_override_non_oauth_model_still_gets_primary_token`), which encoded
 /// the defect.
 ///
-/// Revert-to-red: dropping the `platform_takes_session_credential` term from
-/// `oauth_registry::session_key_for_endpoint` makes `api_key` `Some("kimi-secret")`.
+/// Revert-to-red: make `CredentialAuthority::governing_manager`'s
+/// `Some(platform) => None` arm return `self.primary.clone()` and `api_key`
+/// becomes `Some("kimi-secret")`.
 #[tokio::test]
 async fn subagent_override_api_key_platform_never_gets_the_primary_token() {
     let (_kd, manager) = kimi_primary_with_token("kimi-secret");