F3: Kimi inference pipeline + full grok cloud-surface excision

Sampler / inference (PRD F3):
- kimi_compat.rs: single adaptation point for the Kimi chat/completions
  dialect (thinking-field mapping, model_id stripping, empty-content
  tool-call message fix, stream_options.include_usage), with kimi-cli
  source citations
- Rate-limit handling reworked for Kimi/Moonshot semantics; UA kigi/{version}
- /models replaces the xAI models-v2 endpoint everywhere; idle model
  refresh carries X-Msh-* device headers only (X-XAI-Token-Auth and
  x-grok-client-mode/CLIENT_MODE_HEADER machinery deleted)

Cloud-surface excision (PRD §5, zero-egress):
- remote/ conversations lane, cli-chat-proxy-types crate, prod/ dir,
  share command, credit bar: deleted (single local session lane;
  paginate() replaces merge_and_paginate)
- Subscription/tier gate stack deleted end-to-end: AppView
  gate/tier/team/ZDR fields, app/subscription.rs watch loop,
  dispatch/billing.rs paywall + SuperGrok upsell, free-usage-exhausted
  chain, tier-restricted commands, GateInfo, RemoteSettings gate fields,
  SettingsUpdateNotification gate fields
- /privacy + coding-data-sharing setting deleted (backed by a dead xAI
  RPC; Kigi is zero-egress — nothing to share or retain remotely)

Auth UX correctness (user-reported):
- Device-flow fixtures now mirror the live Kimi payload shape
  (https://www.kimi.com/code/authorize_device?user_code=..., verified
  against auth.kimi.com); the fabricated auth.kimi.com/device?code=...
  URLs are gone
- open_browser_detached is a no-op under cfg(test): unit tests drove
  wiremock fixture URLs into the real browser (root cause of the
  "garbage mock link" ABCD-1234 tabs)
- Welcome/pager-minimal rebrand: Grok Build -> Kigi, grok.com ->
  kimi.com, "Sign in to Grok" -> "Sign in to Kimi"

crates/codegen/kigi-config-types/src/lib.rs

@@ -282,12 +282,6 @@ pub struct RemoteSettings {
     pub dream_min_sessions: Option<u64>,
     #[serde(default)]
     pub dream_check_interval_secs: Option<u64>,
-    /// Cadence (seconds) of the pager's free→paid subscription watch.
-    /// `0` disables it; the pager clamps and defaults (see its
-    /// `app::subscription` module). Forwarded from the `grok_build_settings`
-    /// remote settings flag via the CCP `/settings` flatten catch-all.
-    #[serde(default)]
-    pub subscription_watch_interval_secs: Option<u64>,
     #[serde(default)]
     pub writeback_enabled: Option<bool>,
     /// OAuth2 provider issuer URL (e.g., "https://auth.x.ai"). When present
@@ -601,10 +595,6 @@ pub struct RemoteSettings {
     /// is a separate client tier gate.
     #[serde(default)]
     pub voice_mode_enabled: Option<bool>,
-    /// Whether ZDR (Zero Data Retention) users are allowed to use the product.
-    /// Controlled via remote settings. Default `false` (blocked) during beta.
-    #[serde(default)]
-    pub zdr_access_enabled: Option<bool>,
     /// remote settings tier of the `remember_tool_approvals` gate (whether per-tool
     /// "Always allow …" prompt options are shown). Lowest precedence; typically
     /// targeted per-org. Default `false`.
@@ -652,33 +642,10 @@ pub struct RemoteSettings {
     /// `"default"`). Used only when no effective TOML permission key is set.
     #[serde(default)]
     pub permission_mode: Option<String>,
-    /// User's subscription tier from remote settings `grok_build_access_gate`.
-    /// E.g. "free", "premium", "supergrok", "supergrok_heavy".
-    /// Stamped on analytics events + user profile for filtering.
-    #[serde(default)]
-    pub subscription_tier: Option<String>,
-    #[serde(default)]
-    pub gate_message: Option<String>,
-    #[serde(default)]
-    pub gate_url: Option<String>,
-    #[serde(default)]
-    pub gate_label: Option<String>,
     /// Whether the session picker groups entries by repo name.
     /// When `None` or `Some(false)`, sessions are shown in a flat list.
     #[serde(default)]
     pub session_picker_grouped: Option<bool>,
-    /// Whether the user is allowed to use Grok Build. Set by remote settings
-    /// `grok_build_access_gate` targeting rules. `None` = no server response
-    /// yet (client uses own fallback check). `Some(false)` = blocked.
-    #[serde(default)]
-    pub allow_access: Option<bool>,
-    /// User-friendly display name for the current subscription tier
-    /// (e.g. "SuperGrok", "X Premium+", "Free", "API Key"). Set by CCP
-    /// from the JWT tier claim (OAuth) or credential kind (API key).
-    /// Free/Invalid OAuth → `"Free"`; API keys → `"API Key"` (Mixpanel
-    /// `api_key`, never free).
-    #[serde(default)]
-    pub subscription_tier_display: Option<String>,
     /// Whether on-demand credit usage is enabled. When `Some(false)`, the
     /// billing extension blocks on-demand cap changes.
     #[serde(default)]