F3: Kimi inference pipeline + full grok cloud-surface excision

Sampler / inference (PRD F3):
- kimi_compat.rs: single adaptation point for the Kimi chat/completions
  dialect (thinking-field mapping, model_id stripping, empty-content
  tool-call message fix, stream_options.include_usage), with kimi-cli
  source citations
- Rate-limit handling reworked for Kimi/Moonshot semantics; UA kigi/{version}
- /models replaces the xAI models-v2 endpoint everywhere; idle model
  refresh carries X-Msh-* device headers only (X-XAI-Token-Auth and
  x-grok-client-mode/CLIENT_MODE_HEADER machinery deleted)

Cloud-surface excision (PRD §5, zero-egress):
- remote/ conversations lane, cli-chat-proxy-types crate, prod/ dir,
  share command, credit bar: deleted (single local session lane;
  paginate() replaces merge_and_paginate)
- Subscription/tier gate stack deleted end-to-end: AppView
  gate/tier/team/ZDR fields, app/subscription.rs watch loop,
  dispatch/billing.rs paywall + SuperGrok upsell, free-usage-exhausted
  chain, tier-restricted commands, GateInfo, RemoteSettings gate fields,
  SettingsUpdateNotification gate fields
- /privacy + coding-data-sharing setting deleted (backed by a dead xAI
  RPC; Kigi is zero-egress — nothing to share or retain remotely)

Auth UX correctness (user-reported):
- Device-flow fixtures now mirror the live Kimi payload shape
  (https://www.kimi.com/code/authorize_device?user_code=..., verified
  against auth.kimi.com); the fabricated auth.kimi.com/device?code=...
  URLs are gone
- open_browser_detached is a no-op under cfg(test): unit tests drove
  wiremock fixture URLs into the real browser (root cause of the
  "garbage mock link" ABCD-1234 tabs)
- Welcome/pager-minimal rebrand: Grok Build -> Kigi, grok.com ->
  kimi.com, "Sign in to Grok" -> "Sign in to Kimi"

crates/codegen/kigi-tui/src/app/dispatch/auth.rs

@@ -274,7 +274,7 @@ pub(super) fn handle_auth_complete(
 
         app.auth_state = AuthState::Done;
         app.auth_show_raw_url = false;
-        app.welcome_prompt_focused = !app.is_access_blocked();
+        app.welcome_prompt_focused = true;
         app.auth_code_input.clear();
 
         // Mid-session re-auth (`/login` or a 401 prompt): restore the
@@ -312,9 +312,6 @@ pub(super) fn handle_auth_complete(
                 }
             }
             let mut effects = dispatch(Action::RequestBundleStatus, app);
-            if app.usage_visible {
-                effects.push(Effect::FetchAppBilling);
-            }
             effects.extend(retry_effects);
             return effects;
         }
@@ -322,27 +319,9 @@ pub(super) fn handle_auth_complete(
         // status only; shell auto-syncs post-auth
         let mut effects = dispatch(Action::RequestBundleStatus, app);
 
-        // Start auto-checking subscription if gated.
-        // Check immediately (don't wait 5s) then schedule the timer.
-        if !app.has_access() {
-            app.paywall_check_started = Some(std::time::Instant::now());
-            effects.push(Effect::CheckSubscription { verify: None });
-            effects.push(Effect::SchedulePaywallCheck);
-        }
-        // Fetch billing so the welcome screen can show a credit warning.
-        if app.usage_visible {
-            effects.push(Effect::FetchAppBilling);
-        }
         // Fetch changelog (mirrors startup path for interactive login).
         effects.push(Effect::FetchChangelog);
 
-        // ZDR-blocked users stay on the welcome screen — discard any
-        // deferred startup (they cannot start a session).
-        if app.is_zdr_blocked() {
-            clear_startup_actions(app);
-            return effects;
-        }
-
         // Replay deferred session startup once BOTH gates are open. Auth
         // is now Done, so `session_startup_allowed()` here means "is trust
         // also resolved?" -- if trust is still Pending its question renders