Rebrand auth guidance strings: grok login/logout -> kigi login/logout

The headless not-signed-in message still pointed at `grok login` and
XAI_API_KEY; error copy across the shell (re-auth prompts, managed-config
rejection, mcp doctor, trace classifier) and kigi-bin did too. All now
reference `kigi login` / `kigi logout`, and the headless fallback points
at the Moonshot open-platform key (KIGI_MOONSHOT_API_KEY).

crates/codegen/kigi-tui/src/app/acp_handler/tests/session_events.rs

@@ -316,8 +316,8 @@
         ));
     }
 
-    /// Legacy WebLogin auth keeps its verbose message (with `grok logout` /
-    /// `grok login` guidance), not the generic re-auth prompt.
+    /// Legacy WebLogin auth keeps its verbose message (with `kigi logout` /
+    /// `kigi login` guidance), not the generic re-auth prompt.
     #[test]
     fn apply_retry_state_legacy_auth_keeps_detailed_message() {
         let mut session = make_session(Some("s1"));
@@ -326,7 +326,7 @@
             &RetryState::Failed {
                 error_type: "legacy_auth".into(),
                 message: "Unauthorized (401) ... deprecated authentication method (WebLogin) ... \
-                          run `grok logout` then `grok login`"
+                          run `kigi logout` then `kigi login`"
                     .into(),
             },
             &mut session,

crates/codegen/kigi-tui/src/headless.rs

@@ -505,14 +505,12 @@ fn auto_respond_to_permissions(
 /// "Not signed in" error message, tailored to the session type.
 fn auth_required_message(interactive: bool) -> String {
     if interactive {
-        "Not signed in. Run `grok login` to authenticate \
-         (or `grok login --device-code` if no browser is available)."
-            .to_string()
+        "Not signed in. Run `kigi login` to authenticate with Kimi Code.".to_string()
     } else {
-        "Not signed in. To authenticate without a browser, run:\n  \
-         grok login --device-code\n\n\
-         Alternatively, set the XAI_API_KEY environment variable \
-         or run `grok login` on a machine with a browser."
+        "Not signed in. Run `kigi login` to authenticate with Kimi Code \
+         (the device flow prints a URL you can open on any machine).\n\
+         Alternatively, set a Moonshot open-platform API key via \
+         KIGI_MOONSHOT_API_KEY."
             .to_string()
     }
 }
@@ -870,7 +868,6 @@ pub async fn run_single_turn(
         cwd: Some(&cwd),
         is_headless: true,
         cli_subagents: None,
-        cli_web_search_model: None,
         cli_session_summary_model: None,
         cli_experimental_memory: false,
         cli_no_memory: false,