Add per-provider auth.json keys; make auth methods registry-generic (P0b)

Platform API keys now live in auth.json under the platform-id scope (the
per-provider auth.json key contract), resolved env > auth.json > legacy
[platforms.*] config.toml (read-only fallback). The TUI login picker,
paste box, auth-method advertising, and authenticate handler are all
registry-generic: a new PlatformSpec row appears in the login UI and
authenticates with zero UI changes. Spec rows gained vendor/console_host/
login_label display fields (moonshot strings byte-identical, pinned by
tests).

Adversarial review caught that auth.json keys were validated at login but
never stamped onto catalog entries (completions would 401; restart lost
eager auth). Fixed red-green: resolve_model_list/resolve_model_catalog now
take a resolved PlatformApiKeys snapshot consumed by the credential-
stamping layer (auth.json beats stale config.toml, matching the login
validator), with production callers resolving fresh per catalog build.
Also from review: the new auth.json writer takes the manager's cross-
process flock (bounded retry — an unlocked RMW racing a token refresh
could revert a rotated refresh token); the oauth-401 wiremock test is
hermetic (KIGI_SHARE_DIR tempdir; it could read a dev's real auth.json
and hit live moonshot); cli_models resolves real keys; auth.json is read
once per registry sweep; caller-less lock_config_writes deleted; catalog
resolvers tightened to pub(crate); stale config.toml doc comments and the
no-credentials error copy updated.

crates/codegen/kigi-tui/src/app/actions.rs

@@ -574,9 +574,9 @@ pub enum Action {
     BeginPlatformKeyEntry(crate::app::app_view::PlatformLogin),
     /// Esc from the API-key entry box: return to the login picker.
     CancelPlatformKeyEntry,
-    /// User submitted a pasted Moonshot API key: persist it to
-    /// `[platforms.<id>]` in config.toml, then authenticate with the
-    /// platform's method id. The key must never be logged.
+    /// User submitted a pasted platform API key: persist it to auth.json
+    /// under the platform-id scope, then authenticate with the platform's
+    /// method id. The key must never be logged.
     SubmitPlatformApiKey(String),
     /// Copy the auth URL to the clipboard during authentication.
     CopyAuthUrl,
@@ -1612,7 +1612,7 @@ pub enum Effect {
     PollAuthUrl { request_seq: u64 },
     /// Submit a manually-pasted auth code (ext request).
     SubmitAuthCode { request_seq: u64, code: String },
-    /// Persist a Moonshot API key to `[platforms.<id>]` in config.toml, then
+    /// Persist a platform API key to auth.json (platform-id scope), then
     /// send AuthenticateRequest with the platform's method id. SECURITY: the
     /// key must never appear in logs or errors.
     PersistPlatformApiKeyAndAuthenticate {