M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-tools/src/registry/types.rs

@@ -263,16 +263,6 @@ pub struct SessionContext {
     /// passed to every session. Same pattern as `fs` and `backend`.
     /// When `Some`, inserted into `Resources` so `LspTool` can use it.
     pub lsp: Option<std::sync::Arc<dyn crate::implementations::lsp::LspBackend>>,
-    /// Optional image generation configuration. When `Enabled`, an `ImageGenClient`
-    /// is created and injected into `Resources` so the `image_gen` tool can
-    /// call the xAI Imagine API. When `Disabled` (default), the tool is not
-    /// registered and image generation is unavailable.
-    pub image_gen_config: crate::implementations::grok_build::image_gen::ImageGenConfig,
-    /// Optional video generation configuration. When `Enabled`, a `VideoGenClient`
-    /// is created and injected into `Resources` so the `video_gen` tool can
-    /// call the xAI Video Generation API. When `Disabled` (default), the tool is not
-    /// registered and video generation is unavailable.
-    pub video_gen_config: crate::implementations::grok_build::video_gen::VideoGenConfig,
     /// Optional deploy service configuration. When enabled, the
     /// `deploy_app` tool connects to the service at call time using the shared
     /// API key provider.
@@ -284,7 +274,7 @@ pub struct SessionContext {
     /// Prevents 401 failures when a session outlives the initial token lifetime.
     pub api_key_provider: Option<crate::types::SharedApiKeyProvider>,
     /// Optional 401-attribution callback for tool HTTP clients. When
-    /// set, a 401 from `image_gen` / `video_gen` / `web_search`
+    /// set, a 401 from `web_search`
     /// emits an `auth_401_attribution` event via this hook. Hosts can
     /// wire this to the same attribution sink used for inference-side
     /// 401s so tool and chat auth failures share one telemetry path.
@@ -673,10 +663,6 @@ impl ToolRegistryBuilder {
         b.register::<grok_build::WebSearchTool>();
         b.register_with_params::<grok_build::WebFetchTool, grok_build::web_fetch::WebFetchParams>();
         b.register::<grok_build::LspTool>();
-        b.register::<grok_build::ImageGenTool>();
-        b.register::<grok_build::ImageEditTool>();
-        b.register::<grok_build::ImageToVideoTool>();
-        b.register::<grok_build::ReferenceToVideoTool>();
         b.register::<grok_build::EnterPlanModeTool>();
         b.register::<grok_build::ExitPlanModeTool>();
         b.register_with_params::<
@@ -994,34 +980,6 @@ impl ToolRegistryBuilder {
         if let Some(lsp) = ctx.lsp {
             resources.insert(lsp);
         }
-        if ctx.image_gen_config.has_credentials() {
-            match crate::implementations::grok_build::image_gen::ImageGenClient::new(
-                &ctx.image_gen_config,
-                ctx.api_key_provider.clone(),
-            ) {
-                Ok(client) => {
-                    let client = client.with_attribution_callback(ctx.attribution_callback.clone());
-                    resources.insert(client);
-                }
-                Err(e) => {
-                    tracing::warn!("Failed to create ImageGenClient: {e}");
-                }
-            }
-        }
-        if ctx.video_gen_config.is_enabled() {
-            match crate::implementations::grok_build::video_gen::VideoGenClient::new(
-                &ctx.video_gen_config,
-                ctx.api_key_provider.clone(),
-            ) {
-                Ok(client) => {
-                    let client = client.with_attribution_callback(ctx.attribution_callback.clone());
-                    resources.insert(client);
-                }
-                Err(e) => {
-                    tracing::warn!("Failed to create VideoGenClient: {e}");
-                }
-            }
-        }
         if let crate::implementations::grok_build::web_fetch::WebFetchConfig::Enabled { params } =
             &ctx.web_fetch_config
         {
@@ -1999,10 +1957,6 @@ mod tests {
             web_fetch_config:
                 crate::implementations::grok_build::web_fetch::WebFetchConfig::default(),
             lsp: None,
-            image_gen_config:
-                crate::implementations::grok_build::image_gen::ImageGenConfig::default(),
-            video_gen_config:
-                crate::implementations::grok_build::video_gen::VideoGenConfig::default(),
             app_builder_deployer_config:
                 crate::implementations::grok_build::deploy_app::AppBuilderDeployerConfig::default(),
             api_key_provider: None,
@@ -2148,7 +2102,6 @@ mod tests {
     #[tokio::test]
     async fn full_toolset_descriptions_render_cleanly() {
         use crate::implementations::grok_build::{
-            IMAGE_GEN_TOOL_NAME, IMAGE_TO_VIDEO_TOOL_NAME, REFERENCE_TO_VIDEO_TOOL_NAME,
             SCHEDULER_CREATE_TOOL_NAME, SCHEDULER_DELETE_TOOL_NAME,
         };
         let builder = ToolRegistryBuilder::new();
@@ -2169,9 +2122,6 @@ mod tests {
                 "web_search",
                 "web_fetch",
                 "lsp",
-                IMAGE_GEN_TOOL_NAME,
-                IMAGE_TO_VIDEO_TOOL_NAME,
-                REFERENCE_TO_VIDEO_TOOL_NAME,
                 "monitor",
                 SCHEDULER_CREATE_TOOL_NAME,
                 SCHEDULER_DELETE_TOOL_NAME,