feat(providers): add Claude Pro/Max subscription OAuth (PKCE-localhost)

27th registry variant, 2nd subscription-OAuth provider. Log in with a Claude
Pro/Max subscription via PKCE authorization-code + S256 (loopback callback on
127.0.0.1:53692, with a manual code-paste fallback), then use it against
api.anthropic.com — reusing the existing Anthropic Messages wire + Anthropic
listing + the multi-provider OAuth foundation (dbce6bf). Sourced from Pi
(earendil-works/pi auth/oauth/anthropic.ts): client 9d1c250a..., authorize
claude.ai/oauth/authorize, token platform.claude.com/v1/oauth/token, scope
'…user:inference user:sessions:claude_code…'.

New machinery (foundation handles token routing — claude-pro-max is a
uses_oauth platform so its bearer/refresh/api_key already route to its own
pooled manager, never Kimi):
- OAuthConfig gains flow{DeviceCode|PkceLocalhost} + token_host + token_body
  {Form|JSON}; xai/kimi rows unchanged (DeviceCode/Form).
- auth/oauth_pkce.rs: PKCE S256 wire — loopback listener with STRICT state
  validation (CSRF, fail-closed), manual-paste fallback, JSON code→token
  exchange + rotating-refresh. Never logs code/verifier/tokens.
- Messages OAuth adaptation gated on SamplerConfig.anthropic_oauth (true only
  for a claude-pro-max managed key): Authorization: Bearer + anthropic-beta
  oauth + user-agent claude-cli + x-app cli, and the required 'You are Claude
  Code' system prefix. API-key anthropic/minimax Messages requests are
  BYTE-IDENTICAL (regression-guarded).
- Live /models under the OAuth Bearer + oauth-beta headers (Anthropic listing,
  enriched from models.dev anthropic); persistent 401 → 0 models + WARN, NO
  hardcoded fallback list (honest failure).

Adversarial review: no blocking findings (secret handling, CSRF/state, the
anthropic_oauth gate, token routing, non-regression all CONFIRMED). Full gate
green. Registry at 27; picker updated. Residual (unverifiable without a real
Claude Pro/Max account): whether GET /v1/models accepts the OAuth bearer, and
the real endpoint's acceptance of the OAuth Messages request.

crates/codegen/kigi-shell/src/auth/oauth_registry.rs

@@ -141,6 +141,52 @@ mod tests {
             .expect("xai-grok carries an OAuthConfig")
     }
 
+    fn claude_oauth() -> &'static kigi_models::OAuthConfig {
+        kigi_models::PlatformId::ClaudeProMax
+            .oauth()
+            .expect("claude-pro-max carries an OAuthConfig")
+    }
+
+    /// A `claude-pro-max/<model>` turn resolves to the process-global pooled
+    /// claude-pro-max manager (its OWN `oauth/claude-pro-max` scope), NEVER the
+    /// primary Kimi manager — the same leak-safe routing as xai-grok, and a
+    /// DISTINCT pool entry from the xai manager.
+    #[tokio::test]
+    async fn claude_pro_max_model_resolves_to_its_own_manager_not_kimi() {
+        let (_kd, kimi) = primary_with_token("kimi-tok");
+        let home = tempfile::tempdir().unwrap();
+        let resolved =
+            manager_for_model(home.path(), "claude-pro-max/claude-opus-4-8", Some(&kimi))
+                .expect("claude-pro-max model resolves to its pooled manager");
+        assert!(
+            !Arc::ptr_eq(&resolved, &kimi),
+            "claude-pro-max must NOT resolve to the Kimi manager"
+        );
+        assert!(
+            Arc::ptr_eq(&resolved, &global_manager_for(home.path(), claude_oauth())),
+            "claude-pro-max must resolve to its OWN process-global pooled manager"
+        );
+        // And it is a DIFFERENT manager than xai-grok's pooled one.
+        assert!(
+            !Arc::ptr_eq(&resolved, &global_manager_for(home.path(), xai_oauth())),
+            "claude-pro-max and xai-grok must not share a pooled manager"
+        );
+    }
+
+    /// Fail-fast (no Kimi fallback): a claude-pro-max key with a Kimi primary
+    /// never yields the Kimi session token — it draws from the claude pool (its
+    /// own token, or `None`), so the Kimi bearer can never reach api.anthropic.
+    #[tokio::test]
+    async fn session_key_for_claude_pro_max_is_never_the_kimi_primary() {
+        let (_kd, kimi) = primary_with_token("kimi-tok");
+        let home = tempfile::tempdir().unwrap();
+        assert_ne!(
+            session_key_for_model(home.path(), "claude-pro-max/claude-opus-4-8", Some(&kimi)),
+            Some("kimi-tok".to_string()),
+            "a claude-pro-max model must never receive the primary Kimi session token"
+        );
+    }
+
     /// A non-OAuth managed key (moonshot-cn/…) and an unprefixed bare id both
     /// route to the primary Kimi manager — the Kimi / first-party path is
     /// untouched and never consults the pool (no runtime needed).