M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-mcp/src/servers.rs

@@ -46,7 +46,7 @@ pub use kigi_workspace_types::MCP_TOOL_NAME_DELIMITER;
 
 /// Normalize an MCP server URL for comparison: strip trailing slashes.
 /// Must match the normalization the host's managed-config layer uses
-/// (e.g. shell's `session::managed_mcp::normalize_url`) so refresh
+/// (e.g. shell's `session::managed_mcp::normalize_url`) so URL
 /// lookup keys agree.
 fn normalize_url(url: &str) -> String {
     url.trim_end_matches('/').to_string()
@@ -112,7 +112,7 @@ pub struct McpConfigDiff {
     pub retained: Vec<McpServerName>,
 }
 
-/// MCP server name used as the key in client/tool maps (e.g. `"github"`, `"grok_com_linear"`).
+/// MCP server name used as the key in client/tool maps (e.g. `"github"`).
 pub type McpServerName = String;
 
 /// Unqualified MCP tool name (e.g. `"create_issue"`, without the `server__` prefix).
@@ -4012,16 +4012,6 @@ fn is_figma_mcp(server_name: &str, url: &str) -> bool {
     if server_name.eq_ignore_ascii_case("figma") {
         return true;
     }
-    // Legacy direct managed name (`grok_com_figma`); newer clients use gateway tools (`managed_mcp_gateway_tools_enabled`).
-    const MANAGED_PREFIX: &str = "grok_com_";
-    if let (Some(prefix), Some(rest)) = (
-        server_name.get(..MANAGED_PREFIX.len()),
-        server_name.get(MANAGED_PREFIX.len()..),
-    ) && prefix.eq_ignore_ascii_case(MANAGED_PREFIX)
-        && rest.eq_ignore_ascii_case("figma")
-    {
-        return true;
-    }
     reqwest::Url::parse(url)
         .ok()
         .and_then(|u| u.host_str().map(|h| h.to_ascii_lowercase()))
@@ -4510,14 +4500,10 @@ mod tests {
     fn is_figma_mcp_matches_name_and_host() {
         assert!(is_figma_mcp("figma", "https://example.com/mcp"));
         assert!(is_figma_mcp("Figma", "https://example.com/mcp"));
-        assert!(is_figma_mcp("grok_com_figma", "https://example.com/mcp"));
-        assert!(is_figma_mcp("GROK_COM_FIGMA", "https://example.com/mcp"));
-        assert!(is_figma_mcp("grok_com_FIGMA", "https://example.com/mcp"));
         assert!(is_figma_mcp("other", "https://mcp.figma.com/mcp"));
         assert!(is_figma_mcp("other", "https://figma.com/mcp"));
         assert!(!is_figma_mcp("linear", "https://mcp.linear.app/mcp"));
         assert!(!is_figma_mcp("figma_extra", "https://example.com/mcp"));
-        assert!(!is_figma_mcp("grok_com_linear", "https://example.com/mcp"));
         assert!(!is_figma_mcp("linear", "not-a-url"));
         assert!(!is_figma_mcp("linear", "https://notfigma.com/mcp"));
         assert!(!is_figma_mcp("linear", "https://figma.com.evil/mcp"));
@@ -6762,7 +6748,7 @@ mod tests {
     fn is_auth_rejection_message_matches_auth_signals() {
         // The verbatim string captured in production for a managed handshake.
         assert!(is_auth_rejection_message(
-            "MCP server 'grok_com_notion' handshake failed: Auth required, when send initialize request"
+            "MCP server 'notion' handshake failed: Auth required, when send initialize request"
         ));
         assert!(is_auth_rejection_message("401 Unauthorized"));
         assert!(is_auth_rejection_message("unauthorized"));