M1/F2+F4: platform registry, Moonshot API-key channel, dynamic model sync

F2 — fixed three-platform registry in kigi-models: kimi-code
(subscription, OAuth bearer, base kigi_env::coding_api_base_url()),
moonshot-cn (https://api.moonshot.cn/v1), moonshot-ai
(https://api.moonshot.ai/v1) with kimi-k model-prefix filtering.
Moonshot API keys via KIGI_MOONSHOT_CN_API_KEY / KIGI_MOONSHOT_AI_API_KEY
(+ KIGI_MOONSHOT_API_KEY shared fallback) or ~/.kigi/config.toml;
values redacted from logs/display.

F4 — model catalog now syncs from GET {base}/models (Bearer auth,
wire shape per official kimi-cli: id/context_length/supports_reasoning/
supports_image_in/supports_video_in/display_name) with the official
capability-derivation rules (thinking / always_thinking-in-name /
kimi-k2 implicit set). Managed keys {platform_id}/{model_id}; default
model = first list entry; default thinking iff capabilities contain
thinking/always_thinking. Sync failure → last cache; no cache →
built-in fallback table seeded from ids sourced in official kimi-cli
(kimi-for-coding, kimi-k2-turbo-preview, kimi-k2-thinking-turbo).
401 during sync forces one token refresh and retries.

Model resolution priority preserved: CLI > env > config > server >
fallback. Grok model artifacts (grok-4*/grok-build catalog, tier
gating remnants) removed from non-test code.

All first-party endpoints re-verified live: device_authorization mints
real codes; /models on all three platforms answers with real API auth
errors when unauthenticated.

Gates: check/clippy --all-targets 0/0, fmt clean, deny ok,
kigi-shell lib 5136 green, kigi-tui lib 6819 green, kigi-models 8.

crates/codegen/kigi-shell/src/agent/mvp_agent/acp_agent.rs

@@ -1368,12 +1368,20 @@ impl acp::Agent for MvpAgent {
             .take(10).collect::< Vec < _ >> (),
             "load_session: restoring persisted model (debug)"
         );
-        let is_grok_build = persisted_model.0.starts_with("grok-build");
-        let same_family_fallback = if is_grok_build {
-            available.keys().find(|id| id.0.starts_with("grok-build")).cloned()
-        } else {
-            available.keys().find(|id| !id.0.starts_with("grok-build")).cloned()
-        };
+        // "Same family" = same platform: catalog keys are
+        // `{platform_id}/{model_id}` (PRD F4), so prefer a replacement from
+        // the platform the persisted model belonged to (its credentials are
+        // known-good) before falling back across platforms.
+        let persisted_platform =
+            kigi_models::parse_managed_model_key(persisted_model.0.as_ref()).map(|(p, _)| p);
+        let same_family_fallback = available
+            .keys()
+            .find(|id| {
+                kigi_models::parse_managed_model_key(id.0.as_ref()).map(|(p, _)| p)
+                    == persisted_platform
+            })
+            .cloned()
+            .or_else(|| available.keys().next().cloned());
         let selectable_catalog_key = selectable_catalog_key_for_persisted(
             &models,
             &available,