feat(ai): support Grok subscription authentication

[rynfar]

Grok subscribers could not authenticate or route requests through xAI's subscription Responses API. Adopt upstream PrimeIntellect-ai#2252 device-code OAuth, refresh and model routing, retaining API-key access, Pylon scoped provider hooks, recovery cursors and the existing configuration menu.

Auth changes refresh active and maintenance request models. Shared streaming handles interleaved tool arguments and encrypted reasoning. No daemon wire or capability contract changes.

Validation: 580 focused tests passed; four optional AI tests skipped. npm run check and pre-commit checks passed. Review covered failed refresh, API-key/subscription switching, maintenance requests and Codex streaming. No paid provider calls were used.

Fixes #68. Maintainer authorized review and merge after green checks in the Pylon task conversation. Managed delivery is tracked by pylon-code/pylon#557.

Implemented and reviewed with GPT-6 Astra in Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}