F7: one-time read-only import of the official kimi-cli configuration

New `kigi import-kimi` (with --dry-run) plus a one-time welcome-screen
hint when ~/.kimi/config.toml is present and unimported.

- Sources: ~/.kimi/config.toml (default_model, [models.*], [providers.*])
  and ~/.kimi/mcp.json ({"mcpServers": ...} — parsed by the existing
  McpConfig machinery). Shapes ported from kimi-cli 1.49.0 config.py with
  citations.
- Strictly read-only over ~/.kimi: plain reads only; the test suite pins
  byte-identical contents AND unchanged mtimes across scan+apply. Keyring
  credentials are never imported; KIMI_SHARE_DIR / any KIMI_* env var is
  never consulted (official dir hardcoded to ~/.kimi).
- Mapping: MCP servers merge into kigi [mcp_servers.*] without clobbering
  existing names; models on non-built-in providers become kigi [model.*]
  custom entries (base_url + api_key + context_window); providers that
  duplicate kigi's built-in Kimi/Moonshot platforms are skipped with a
  note; default_model maps to the imported alias or the managed catalog
  key and never overwrites an existing default.
- One-time marker ~/.kigi/kimi_import_done (claude-import convention);
  the startup hint and re-runs no-op once set. api_key values flow only
  into the user's own config.toml and are redacted in every summary.

Verified end-to-end with the real binary in a sandboxed home: dry-run,
apply, `kigi mcp list` shows both imported servers, second run no-ops,
~/.kimi mtimes unchanged. 8 unit tests + CLI parse test.

crates/codegen/kigi-bin/src/main.rs

@@ -1567,6 +1567,10 @@ async fn async_main() -> Result<()> {
                 kigi_shell::inspect::inspect(&cwd, json).await?;
                 return Ok(());
             }
+            Command::ImportKimi { dry_run } => {
+                init_tracing_simple("cli");
+                return kigi_tui::import_kimi_cmd::run(dry_run);
+            }
             Command::Setup { json } => {
                 init_tracing_simple("cli");
                 run_setup_command(json).await;