F3: Kimi inference pipeline + full grok cloud-surface excision

Sampler / inference (PRD F3):
- kimi_compat.rs: single adaptation point for the Kimi chat/completions
  dialect (thinking-field mapping, model_id stripping, empty-content
  tool-call message fix, stream_options.include_usage), with kimi-cli
  source citations
- Rate-limit handling reworked for Kimi/Moonshot semantics; UA kigi/{version}
- /models replaces the xAI models-v2 endpoint everywhere; idle model
  refresh carries X-Msh-* device headers only (X-XAI-Token-Auth and
  x-grok-client-mode/CLIENT_MODE_HEADER machinery deleted)

Cloud-surface excision (PRD §5, zero-egress):
- remote/ conversations lane, cli-chat-proxy-types crate, prod/ dir,
  share command, credit bar: deleted (single local session lane;
  paginate() replaces merge_and_paginate)
- Subscription/tier gate stack deleted end-to-end: AppView
  gate/tier/team/ZDR fields, app/subscription.rs watch loop,
  dispatch/billing.rs paywall + SuperGrok upsell, free-usage-exhausted
  chain, tier-restricted commands, GateInfo, RemoteSettings gate fields,
  SettingsUpdateNotification gate fields
- /privacy + coding-data-sharing setting deleted (backed by a dead xAI
  RPC; Kigi is zero-egress — nothing to share or retain remotely)

Auth UX correctness (user-reported):
- Device-flow fixtures now mirror the live Kimi payload shape
  (https://www.kimi.com/code/authorize_device?user_code=..., verified
  against auth.kimi.com); the fabricated auth.kimi.com/device?code=...
  URLs are gone
- open_browser_detached is a no-op under cfg(test): unit tests drove
  wiremock fixture URLs into the real browser (root cause of the
  "garbage mock link" ABCD-1234 tabs)
- Welcome/pager-minimal rebrand: Grok Build -> Kigi, grok.com ->
  kimi.com, "Sign in to Grok" -> "Sign in to Kimi"

crates/codegen/kigi-shell/src/auth/device_code.rs

@@ -150,6 +150,11 @@ async fn complete_device_code_login(
 /// caller can decide how to notify the user (eprintln on CLI, nothing on TUI
 /// where the URL is already rendered in the widget).
 async fn open_browser_detached(url: &str) -> bool {
+    // Unit tests drive the full login flow against mock servers — their
+    // fixture URLs must never reach a real browser.
+    if cfg!(test) {
+        return false;
+    }
     let url = url.to_owned();
     match tokio::task::spawn_blocking(move || webbrowser::open(&url)).await {
         Ok(Ok(())) => true,
@@ -171,13 +176,16 @@ mod tests {
     use wiremock::matchers::{body_string_contains, method, path};
     use wiremock::{Mock, MockServer, ResponseTemplate};
 
+    /// Fixture mirroring the live `device_authorization` payload (verified
+    /// against auth.kimi.com): verification URLs are passed through verbatim
+    /// by the login flow, so they use the real shape.
     fn device_auth_json(code: &str) -> serde_json::Value {
         serde_json::json!({
-            "user_code": "ABCD-1234",
+            "user_code": "WXYZ-6789",
             "device_code": code,
-            "verification_uri": "https://auth.kimi.com/device",
-            "verification_uri_complete": "https://auth.kimi.com/device?code=ABCD-1234",
-            "expires_in": 600,
+            "verification_uri": "https://www.kimi.com/code/authorize_device",
+            "verification_uri_complete": "https://www.kimi.com/code/authorize_device?user_code=WXYZ-6789",
+            "expires_in": 1800,
             "interval": 0, // floored to 1s by the poll loop
         })
     }