M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/common/kigi-tool-protocol/tests/serde_roundtrip.rs

@@ -1451,13 +1451,13 @@ fn tool_definition_mode_concise_supports_alternate_meta_tool_pair() {
 #[test]
 fn tool_error_wire_render_limited_round_trips_with_card_id() {
     let err = ToolErrorWire::RenderLimited {
-        tool_id: ToolId::new("render:imagine_video").unwrap(),
+        tool_id: ToolId::new("render:video_player").unwrap(),
         card_id: Some("card-uuid-123".to_owned()),
         reason: "budget exceeded".to_owned(),
     };
     let v = roundtrip(&err);
     assert_eq!(v["code"], json!("render_limited"));
-    assert_eq!(v["tool_id"], json!("render:imagine_video"));
+    assert_eq!(v["tool_id"], json!("render:video_player"));
     assert_eq!(v["card_id"], json!("card-uuid-123"));
     assert_eq!(v["reason"], json!("budget exceeded"));
 }
@@ -1465,7 +1465,7 @@ fn tool_error_wire_render_limited_round_trips_with_card_id() {
 #[test]
 fn tool_error_wire_render_limited_omits_card_id_when_none() {
     let err = ToolErrorWire::RenderLimited {
-        tool_id: ToolId::new("render:imagine_video").unwrap(),
+        tool_id: ToolId::new("render:video_player").unwrap(),
         card_id: None,
         reason: "budget exceeded".to_owned(),
     };

crates/common/kigi-tool-runtime/src/render.rs

@@ -139,9 +139,6 @@ pub struct ToolChatCompletion {
     /// JSON-encoded card attachment (images, render cards, files).
     #[serde(skip_serializing_if = "Option::is_none")]
     pub card_attachment: Option<String>,
-    /// Media generation type: `"image_gen"`, `"video_gen"`, etc.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub media_gen_type: Option<String>,
     /// Code execution result.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub code_execution_result: Option<ToolCodeExecutionResult>,