Rebrand auth guidance strings: grok login/logout -> kigi login/logout

The headless not-signed-in message still pointed at `grok login` and
XAI_API_KEY; error copy across the shell (re-auth prompts, managed-config
rejection, mcp doctor, trace classifier) and kigi-bin did too. All now
reference `kigi login` / `kigi logout`, and the headless fallback points
at the Moonshot open-platform key (KIGI_MOONSHOT_API_KEY).

crates/codegen/kigi-tui/src/headless.rs

@@ -505,14 +505,12 @@ fn auto_respond_to_permissions(
 /// "Not signed in" error message, tailored to the session type.
 fn auth_required_message(interactive: bool) -> String {
     if interactive {
-        "Not signed in. Run `grok login` to authenticate \
-         (or `grok login --device-code` if no browser is available)."
-            .to_string()
+        "Not signed in. Run `kigi login` to authenticate with Kimi Code.".to_string()
     } else {
-        "Not signed in. To authenticate without a browser, run:\n  \
-         grok login --device-code\n\n\
-         Alternatively, set the XAI_API_KEY environment variable \
-         or run `grok login` on a machine with a browser."
+        "Not signed in. Run `kigi login` to authenticate with Kimi Code \
+         (the device flow prints a URL you can open on any machine).\n\
+         Alternatively, set a Moonshot open-platform API key via \
+         KIGI_MOONSHOT_API_KEY."
             .to_string()
     }
 }
@@ -870,7 +868,6 @@ pub async fn run_single_turn(
         cwd: Some(&cwd),
         is_headless: true,
         cli_subagents: None,
-        cli_web_search_model: None,
         cli_session_summary_model: None,
         cli_experimental_memory: false,
         cli_no_memory: false,