M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-config-types/src/lib.rs

@@ -445,11 +445,6 @@ pub struct RemoteSettings {
         skip_serializing_if = "Vec::is_empty"
     )]
     pub goal_skeptic_models: Vec<GoalRoleModel>,
-    /// Remote fallback for managed MCP connector fetching.
-    #[serde(default)]
-    pub managed_mcps_enabled: Option<bool>,
-    #[serde(default)]
-    pub managed_mcp_gateway_tools_enabled: Option<bool>,
     /// Enable user-facing feedback (heuristic popups, `/feedback` command).
     #[serde(default)]
     pub feedback_enabled: Option<bool>,
@@ -517,20 +512,6 @@ pub struct RemoteSettings {
     /// is set in config.toml. Absent → default (**disabled** — ships dark).
     #[serde(default)]
     pub subagent_worktree_snapshot_enabled: Option<bool>,
-    /// When `Some(true)`, enable the `image_gen` tool for session-based auth users.
-    /// When `Some(false)` or absent, the tool is hidden regardless of credentials.
-    #[serde(default)]
-    pub image_gen_enabled: Option<bool>,
-    /// remote settings flag: optional Imagine model override for `image_gen`.
-    /// When present and non-empty, `image_gen` uses this model slug
-    /// (e.g. `grok-imagine-image`) instead of the default quality model
-    /// (`grok-imagine-image-quality`). Absent/empty → default model.
-    #[serde(default)]
-    pub image_gen_model_override: Option<String>,
-    /// When `Some(true)`, enable the `video_gen` tool for session-based auth users.
-    /// When `Some(false)` or absent, the tool is hidden regardless of credentials.
-    #[serde(default)]
-    pub video_gen_enabled: Option<bool>,
     /// When `Some(true)`, enable the process-wide image normalize cache that
     /// amortises decode + integrity-check + re-encode work across SessionActors.
     /// Default: disabled. See `session::normalize_cache`.
@@ -687,13 +668,6 @@ pub struct RemoteSettings {
     /// remote settings verbatim-input flag; env (`KIGI_COMPACTION_VERBATIM_INPUT`) and config override it. `None` = default (true).
     #[serde(default)]
     pub compaction_verbatim_input: Option<bool>,
-    /// remote settings denylist of optional imagine tools to disable
-    /// (e.g. `["image_edit"]`). When a tool is listed it is authoritatively
-    /// removed from the toolset and local env/config can't re-enable it.
-    /// Absent or not listed → each tool keeps its own default.
-    /// See `Config::resolve_image_edit`.
-    #[serde(default)]
-    pub imagine_tools_disabled: Option<Vec<String>>,
     /// Master switch for jemalloc heap sampling + threshold dumps.
     /// `Some(true)` enables, `Some(false)` kill-switch, `None` = client default off.
     #[serde(default)]
@@ -706,16 +680,6 @@ pub struct RemoteSettings {
     #[serde(default)]
     pub jemalloc_heap_profile_poll_interval_secs: Option<u64>,
 }
-impl RemoteSettings {
-    /// Denylist check for an optional imagine tool. Returns `true` when the
-    /// server sent `imagine_tools_disabled` and it contains `tool` (force-off);
-    /// otherwise `false` (defer to the tool's own default).
-    pub fn imagine_tool_disabled(&self, tool: &str) -> bool {
-        self.imagine_tools_disabled
-            .as_ref()
-            .is_some_and(|list| list.iter().any(|t| t == tool))
-    }
-}
 /// Remote enable tier for the per-tip contextual hints (mirrors the client's
 /// `[ui.contextual_hints]` shape). Each field is a soft default for one tip;
 /// `None` defers to the client default (on). All fields `#[serde(default)]` so