Add per-provider auth.json keys; make auth methods registry-generic (P0b)

Platform API keys now live in auth.json under the platform-id scope (the
per-provider auth.json key contract), resolved env > auth.json > legacy
[platforms.*] config.toml (read-only fallback). The TUI login picker,
paste box, auth-method advertising, and authenticate handler are all
registry-generic: a new PlatformSpec row appears in the login UI and
authenticates with zero UI changes. Spec rows gained vendor/console_host/
login_label display fields (moonshot strings byte-identical, pinned by
tests).

Adversarial review caught that auth.json keys were validated at login but
never stamped onto catalog entries (completions would 401; restart lost
eager auth). Fixed red-green: resolve_model_list/resolve_model_catalog now
take a resolved PlatformApiKeys snapshot consumed by the credential-
stamping layer (auth.json beats stale config.toml, matching the login
validator), with production callers resolving fresh per catalog build.
Also from review: the new auth.json writer takes the manager's cross-
process flock (bounded retry — an unlocked RMW racing a token refresh
could revert a rotated refresh token); the oauth-401 wiremock test is
hermetic (KIGI_SHARE_DIR tempdir; it could read a dev's real auth.json
and hit live moonshot); cli_models resolves real keys; auth.json is read
once per registry sweep; caller-less lock_config_writes deleted; catalog
resolvers tightened to pub(crate); stale config.toml doc comments and the
no-credentials error copy updated.

crates/codegen/kigi-tui/src/views/welcome/mod.rs

@@ -1218,12 +1218,13 @@ fn render_welcome_authenticating(
         }
 
         AuthMode::ApiKeyEntry(target) => {
-            // Moonshot API-key paste box: instruction + input + hints. No
+            // Platform API-key paste box: instruction + input + hints. No
             // auth-URL machinery — the key comes from the platform console.
             let h_pad: u16 = content_area.width / 6;
             let inner_width = content_area.width.saturating_sub(h_pad * 2).max(1);
             let instruction = format!(
-                "Paste your Moonshot API key (from {})",
+                "Paste your {} API key (from {})",
+                target.vendor(),
                 target.console_host()
             );
             let msg_height = (instruction.len() as u16).div_ceil(inner_width);
@@ -2136,7 +2137,9 @@ mod tests {
             &theme,
             logo_line_count(area.height),
             None, // auth_url — none in key-entry mode
-            AuthMode::ApiKeyEntry(crate::app::app_view::PlatformLogin::MoonshotCn),
+            AuthMode::ApiKeyEntry(crate::app::app_view::PlatformLogin(
+                kigi_shell::models::PlatformId::MoonshotCn,
+            )),
             "",    // auth_code_input
             false, // clipboard_copied
             false, // show_raw_url