Add per-provider auth.json keys; make auth methods registry-generic (P0b)

Platform API keys now live in auth.json under the platform-id scope (the
per-provider auth.json key contract), resolved env > auth.json > legacy
[platforms.*] config.toml (read-only fallback). The TUI login picker,
paste box, auth-method advertising, and authenticate handler are all
registry-generic: a new PlatformSpec row appears in the login UI and
authenticates with zero UI changes. Spec rows gained vendor/console_host/
login_label display fields (moonshot strings byte-identical, pinned by
tests).

Adversarial review caught that auth.json keys were validated at login but
never stamped onto catalog entries (completions would 401; restart lost
eager auth). Fixed red-green: resolve_model_list/resolve_model_catalog now
take a resolved PlatformApiKeys snapshot consumed by the credential-
stamping layer (auth.json beats stale config.toml, matching the login
validator), with production callers resolving fresh per catalog build.
Also from review: the new auth.json writer takes the manager's cross-
process flock (bounded retry — an unlocked RMW racing a token refresh
could revert a rotated refresh token); the oauth-401 wiremock test is
hermetic (KIGI_SHARE_DIR tempdir; it could read a dev's real auth.json
and hit live moonshot); cli_models resolves real keys; auth.json is read
once per registry sweep; caller-less lock_config_writes deleted; catalog
resolvers tightened to pub(crate); stale config.toml doc comments and the
no-credentials error copy updated.

crates/codegen/kigi-shell/src/agent/mvp_agent/acp_agent.rs

@@ -508,21 +508,23 @@ impl acp::Agent for MvpAgent {
                 );
                 Ok(self.auth_response_with_meta())
             }
-            auth_method::MOONSHOT_CN_METHOD_ID | auth_method::MOONSHOT_AI_METHOD_ID => {
-                let platform = auth_method::moonshot_platform_for_method_id(
-                        &arguments.method_id,
-                    )
-                    .expect("match arm guarantees a moonshot method id");
-                self.authenticate_moonshot(platform, arguments.method_id.clone())
-                    .await
-            }
             _ => {
-                Err(
-                    acp::Error::invalid_params()
-                        .data(
-                            format!("unsupported auth method: {}", arguments.method_id.0),
-                        ),
-                )
+                if let Some(platform) =
+                    auth_method::platform_for_method_id(&arguments.method_id)
+                {
+                    self.authenticate_api_key_platform(
+                        platform,
+                        arguments.method_id.clone(),
+                    )
+                    .await
+                } else {
+                    Err(
+                        acp::Error::invalid_params()
+                            .data(
+                                format!("unsupported auth method: {}", arguments.method_id.0),
+                            ),
+                    )
+                }
             }
         }
     }