feat(providers): add Claude Pro/Max subscription OAuth (PKCE-localhost)

27th registry variant, 2nd subscription-OAuth provider. Log in with a Claude
Pro/Max subscription via PKCE authorization-code + S256 (loopback callback on
127.0.0.1:53692, with a manual code-paste fallback), then use it against
api.anthropic.com — reusing the existing Anthropic Messages wire + Anthropic
listing + the multi-provider OAuth foundation (dbce6bf). Sourced from Pi
(earendil-works/pi auth/oauth/anthropic.ts): client 9d1c250a..., authorize
claude.ai/oauth/authorize, token platform.claude.com/v1/oauth/token, scope
'…user:inference user:sessions:claude_code…'.

New machinery (foundation handles token routing — claude-pro-max is a
uses_oauth platform so its bearer/refresh/api_key already route to its own
pooled manager, never Kimi):
- OAuthConfig gains flow{DeviceCode|PkceLocalhost} + token_host + token_body
  {Form|JSON}; xai/kimi rows unchanged (DeviceCode/Form).
- auth/oauth_pkce.rs: PKCE S256 wire — loopback listener with STRICT state
  validation (CSRF, fail-closed), manual-paste fallback, JSON code→token
  exchange + rotating-refresh. Never logs code/verifier/tokens.
- Messages OAuth adaptation gated on SamplerConfig.anthropic_oauth (true only
  for a claude-pro-max managed key): Authorization: Bearer + anthropic-beta
  oauth + user-agent claude-cli + x-app cli, and the required 'You are Claude
  Code' system prefix. API-key anthropic/minimax Messages requests are
  BYTE-IDENTICAL (regression-guarded).
- Live /models under the OAuth Bearer + oauth-beta headers (Anthropic listing,
  enriched from models.dev anthropic); persistent 401 → 0 models + WARN, NO
  hardcoded fallback list (honest failure).

Adversarial review: no blocking findings (secret handling, CSRF/state, the
anthropic_oauth gate, token routing, non-regression all CONFIRMED). Full gate
green. Registry at 27; picker updated. Residual (unverifiable without a real
Claude Pro/Max account): whether GET /v1/models accepts the OAuth bearer, and
the real endpoint's acceptance of the OAuth Messages request.

crates/codegen/kigi-sampling-types/src/types.rs

@@ -1060,6 +1060,22 @@ pub fn normalize_effort_echo(value: &mut Value) {
 /// wires (Messages inference and the /v1/models listing).
 pub const ANTHROPIC_VERSION: &str = "2023-06-01";
 
+/// `anthropic-beta` value for the Claude-Code OAuth (Pro/Max subscription)
+/// path — required on BOTH the Messages inference request and the `/v1/models`
+/// listing when the bearer is an OAuth `sk-ant-oat…` token. API-key Anthropic
+/// and MiniMax NEVER send this (their requests stay byte-identical).
+pub const ANTHROPIC_OAUTH_BETA: &str = "claude-code-20250219,oauth-2025-04-20";
+
+/// User-Agent kigi presents on the Claude-Code OAuth path (mirrors the
+/// official Claude Code CLI). OAuth-gated: unrelated to the default kigi UA.
+pub const CLAUDE_CODE_USER_AGENT: &str = "claude-cli/2.1.75";
+
+/// System-prompt prefix REQUIRED on the Claude-Code OAuth Messages path: the
+/// OAuth token is Claude-Code-scoped, so Anthropic rejects the request unless
+/// the system prompt's first block is exactly this line. OAuth-gated.
+pub const CLAUDE_CODE_SYSTEM_PREFIX: &str =
+    "You are Claude Code, Anthropic's official CLI for Claude.";
+
 /// ChatCompletions request-body adaptation dialect. Providers disagree on
 /// how thinking rides an OpenAI-compatible body: Kimi wants
 /// `thinking:{type,effort}`, DeepSeek wants