Rebrand auth guidance strings: grok login/logout -> kigi login/logout

The headless not-signed-in message still pointed at `grok login` and
XAI_API_KEY; error copy across the shell (re-auth prompts, managed-config
rejection, mcp doctor, trace classifier) and kigi-bin did too. All now
reference `kigi login` / `kigi logout`, and the headless fallback points
at the Moonshot open-platform key (KIGI_MOONSHOT_API_KEY).

crates/codegen/kigi-auth/src/auth_provider.rs

@@ -35,7 +35,7 @@ pub trait AuthCredentialProvider: HttpAuth + Send + Sync + 'static {
     /// Return the current credential snapshot. Implementations should
     /// issue a cheap disk re-read (`AuthManager::refresh`) before
     /// snapshotting so callers see updates from sibling processes
-    /// (`grok-desktop`, `grok login`). The `token` field MUST mirror
+    /// (`grok-desktop`, `kigi login`). The `token` field MUST mirror
     /// the bearer that `HttpAuth::apply` would send on the wire so
     /// 401-attribution prefixes match the actual request.
     fn snapshot(&self) -> CredentialSnapshot;