M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-shell/src/auth/attribution.rs

@@ -123,7 +123,7 @@ impl ShellAttribution {
     /// Tool-side counterpart of [`Self::new`]: returns
     /// `Arc<dyn kigi_tools::Auth401AttributionCallback>` for the
     /// `with_attribution_callback(...)` builder on each tool HTTP
-    /// client (`ImageGenClient`, `VideoGenClient`, `WebSearchClient`).
+    /// client (`WebSearchClient`).
     /// The two callbacks share the same underlying impl and emit the
     /// same `auth_401_attribution` event format -- only the trait
     /// signature differs (`SamplingConsumer` vs. `ToolConsumer`).
@@ -161,20 +161,13 @@ impl Auth401AttributionCallback for ShellAttribution {
     }
 }
 
-/// Tool-side hook: each tool client (image_gen, video_gen, web_search)
-/// in `kigi-tools` emits a 401 attribution event through this
-/// trait when its HTTP request returns UNAUTHORIZED. Same shape as
-/// the sampler-side impl above; routes to the same pair of sinks.
-///
-/// `ToolConsumer::VideoGenStart` and `VideoGenPoll` collapse to the
-/// same [`ConsumerKind::VideoGen`] with different op strings so the
-/// gate query can break down video-gen 401s by phase.
+/// Tool-side hook: each tool client (web_search) in `kigi-tools`
+/// emits a 401 attribution event through this trait when its HTTP
+/// request returns UNAUTHORIZED. Same shape as the sampler-side impl
+/// above; routes to the same pair of sinks.
 impl ToolAuth401AttributionCallback for ShellAttribution {
     fn record_401(&self, consumer: ToolConsumer, sent_bearer_prefix: Option<&str>) {
         let (kind, op) = match consumer {
-            ToolConsumer::ImageGen => (ConsumerKind::ImageGen, ""),
-            ToolConsumer::VideoGenStart => (ConsumerKind::VideoGen, "start"),
-            ToolConsumer::VideoGenPoll => (ConsumerKind::VideoGen, "poll"),
             ToolConsumer::WebSearch => (ConsumerKind::WebSearch, ""),
         };
         record_consumer_401(
@@ -207,15 +200,6 @@ pub(crate) enum ConsumerKind {
     /// No per-op discriminator -- the consumer string is just
     /// `"IdleResumeModelRefresh"`.
     IdleResumeModelRefresh,
-    /// `kigi_tools::ToolConsumer::ImageGen` -- Imagine API
-    /// (`POST /images/generations`). No per-op discriminator;
-    /// consumer string is just `"ImageGen"`.
-    ImageGen,
-    /// `kigi_tools::ToolConsumer::VideoGenStart` and
-    /// `VideoGenPoll` -- Video Generation API. The op string is
-    /// `"start"` (`POST /videos/generations`) or `"poll"`
-    /// (`GET /videos/{request_id}`).
-    VideoGen,
     /// `kigi_tools::ToolConsumer::WebSearch` -- web search via
     /// `POST /responses` with a `WebSearch` tool. No per-op
     /// discriminator; consumer string is just `"WebSearch"`.
@@ -230,8 +214,6 @@ impl ConsumerKind {
             Self::FeedbackClient => "FeedbackClient",
             Self::SessionRegistryClient => "SessionRegistryClient",
             Self::IdleResumeModelRefresh => "IdleResumeModelRefresh",
-            Self::ImageGen => "ImageGen",
-            Self::VideoGen => "VideoGen",
             Self::WebSearch => "WebSearch",
         }
     }
@@ -239,13 +221,10 @@ impl ConsumerKind {
     /// `true` for variants that take a per-operation discriminator
     /// appended as `<prefix>.<op>`. `false` for variants whose
     /// `consumer` string is just the prefix
-    /// (`IdleResumeModelRefresh`, `ImageGen`, `WebSearch` -- each is
+    /// (`IdleResumeModelRefresh`, `WebSearch` -- each is
     /// a single endpoint with no sub-operation).
     fn takes_op(self) -> bool {
-        !matches!(
-            self,
-            Self::IdleResumeModelRefresh | Self::ImageGen | Self::WebSearch
-        )
+        !matches!(self, Self::IdleResumeModelRefresh | Self::WebSearch)
     }
 }
 
@@ -261,7 +240,7 @@ fn format_consumer(kind: ConsumerKind, op: &str) -> String {
 /// Emit a single `auth 401 attribution` event for a per-consumer 401.
 ///
 /// Wraps [`record_auth_401`] with the design-doc `consumer` formatting
-/// (e.g., `"FeedbackClient.submit"`, `"VideoGen.start"`).
+/// (e.g., `"FeedbackClient.submit"`, `"WebSearch"`).
 /// All 401 emit sites in `kigi-shell` go through this helper -- the
 /// per-client `record_401_attribution` wrappers in
 /// `agent/feedback_client.rs` and `agent/session_registry_client.rs` each
@@ -606,10 +585,6 @@ mod tests {
                 "ignored",
                 "IdleResumeModelRefresh",
             ),
-            (ConsumerKind::ImageGen, "", "ImageGen"),
-            (ConsumerKind::ImageGen, "ignored", "ImageGen"),
-            (ConsumerKind::VideoGen, "start", "VideoGen.start"),
-            (ConsumerKind::VideoGen, "poll", "VideoGen.poll"),
             (ConsumerKind::WebSearch, "", "WebSearch"),
             (ConsumerKind::WebSearch, "ignored", "WebSearch"),
         ];
@@ -647,12 +622,7 @@ mod tests {
         let cb: Arc<dyn ToolAuth401AttributionCallback> =
             ShellAttribution::new_tool_callback(am_arc.clone(), Some("sid-tool".into()));
 
-        let cases = [
-            (ToolConsumer::ImageGen, "ImageGen"),
-            (ToolConsumer::VideoGenStart, "VideoGen.start"),
-            (ToolConsumer::VideoGenPoll, "VideoGen.poll"),
-            (ToolConsumer::WebSearch, "WebSearch"),
-        ];
+        let cases = [(ToolConsumer::WebSearch, "WebSearch")];
 
         for (consumer, expected_consumer_str) in cases {
             cb.record_401(consumer, Some("bearer-1234567890"));