feat(ai): add xAI Grok subscription OAuth provider

[teddytennant]

Summary

Adds an xai-oauth OAuth provider so SuperGrok and X Premium subscribers can sign in through /login and use Grok models against their subscription, rather than a metered XAI_API_KEY. xAI ships first-class OAuth for coding agents; this wires that flow into the existing provider registry.

The metered xai provider is untouched.

Flow

Authorization code + PKCE against the xAI OIDC issuer (https://auth.x.ai), with a loopback callback on 127.0.0.1:56121 — the redirect URI xAI's own CLI clients use. This is the same shape as the existing Anthropic and Codex providers, so the login dialog's browser-or-paste UX works unchanged (usesCallbackServer: true).

• Authorization and token endpoints come from OIDC discovery and are pinned to the x.ai origin, so a tampered discovery document cannot redirect the token exchange elsewhere.
• The resolved token endpoint is stored alongside the credentials, so refresh needs no discovery round trip; credentials written before that field existed fall back to discovery.
• Refresh responses that omit refresh_token keep the existing one.

Models

generate-models.ts mirrors the metered xAI catalog into xai-oauth, served over the Responses API (grok-build-0.1, grok-4.5, grok-4.3, grok-4.20-*, grok-code-fast-1). Deriving the list rather than hardcoding it means the two catalogs stay in sync on the next regeneration. grok-build-0.1 is the provider default.

Test plan

• packages/ai/test/xai-oauth.test.ts covers registry registration, the PKCE code exchange with the loopback redirect_uri, state-mismatch rejection on a pasted redirect URL, refusal of non-x.ai discovery endpoints, refresh against the stored token endpoint, and OAuth error propagation.
• npm run check clean; existing OAuth, model-registry, and model-resolver suites pass.
• The end-to-end browser login needs a live subscription account and was not exercised in CI.

Notes

Device-code login would additionally cover headless and remote sessions without a pasteable redirect. Left out here to keep this to one flow; happy to add it in a follow-up if you want it.

Note

Add xAI Grok OAuth provider to support SuperGrok and X Premium subscriptions

• Adds a new xai-oauth provider that authenticates via OAuth authorization code + PKCE flow against xAI, so users with SuperGrok or X Premium subscriptions can use Grok models without an XAI_API_KEY.
• Implements the full OAuth flow in xai.ts: OIDC discovery with domain pinning to x.ai, a loopback callback server for automatic code capture, PKCE exchange, and token refresh.
• Generates xai-oauth model entries in models.generated.ts by cloning the existing xai catalog with the openai-responses API.
• Maps XAI_OAUTH_TOKEN env var to the xai-oauth provider and sets grok-build-0.1 as its default model.
• Risk: login requires a Node.js or Bun runtime; it throws in other environments (e.g. browser or edge).

^{Macroscope summarized 7afad24.}

[samuelfaj]

This is gold!

I was already doing this PR.