feat(kiro): headless API-key auth + direct Claude/Kiro route

Adds long-lived API-key (ksk_) authentication for Kiro/AWS CodeWhisperer
and a direct claude:kiro / kiro:claude translation route that avoids the
lossy OpenAI two-hop pivot.

- translator: claude-to-kiro request + kiro-to-claude response translators,
  registered on the exact source:target pair (direct route ahead of the
  OpenAI pivot in index.js). claude-to-kiro uses shared schema constants
  (ROLE/CLAUDE_BLOCK/DEFAULT_IMAGE_MIME) per app convention.
- auth: POST /api/oauth/kiro/api-key imports + validates a key via
  ListAvailableProfiles, persists authMethod="api_key" (no refresh token).
- executor: send tokentype: API_KEY header and try *.amazonaws.com hosts
  first for api-key creds; OAuth keeps kiro.dev first.
- fix: never inject the default placeholder profileArn for api-key auth
  (CodeWhisperer 403s an ARN not owned by the key's account).
- ui: API Key method in the Kiro connect modal; surface api-key accounts
  on the Quota Tracker and provider count.
- stream: env-overridable TTFT vs stall timeouts + Kiro keepalive frame.
- tests: claude-kiro-direct + kiro-profile-arn (11 tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/services/usage/kiro.js

@@ -50,7 +50,19 @@ function parseKiroQuotaData(data) {
 
 export async function getKiroUsage(accessToken, providerSpecificData, proxyOptions = null) {
   const authMethod = providerSpecificData?.authMethod || "builder-id";
-  const profileArn = providerSpecificData?.profileArn || resolveDefaultProfileArn(authMethod);
+  // API-key Kiro connections authenticate the quota API the same way the chat
+  // executor does: a bearer token plus a `tokentype: API_KEY` header so
+  // CodeWhisperer treats it as a long-lived API key rather than an OIDC token.
+  // Without this header the GetUsageLimits call is rejected (401/403).
+  const isApiKey = authMethod === "api_key";
+  const apiKeyHeaders = isApiKey ? { tokentype: "API_KEY" } : {};
+
+  // For api-key auth, never inject the shared default placeholder profileArn —
+  // CodeWhisperer 403s a request whose profileArn isn't owned by the key's
+  // account. Only send a profileArn actually resolved for this connection.
+  const profileArn = isApiKey
+    ? (providerSpecificData?.profileArn || "")
+    : (providerSpecificData?.profileArn || resolveDefaultProfileArn(authMethod));
 
   const getUsageParams = new URLSearchParams({
     isEmailRequired: "true",
@@ -71,6 +83,7 @@ export async function getKiroUsage(accessToken, providerSpecificData, proxyOptio
             "Accept": "application/json",
             "x-amz-user-agent": "aws-sdk-js/1.0.0 KiroIDE",
             "user-agent": "aws-sdk-js/1.0.0 KiroIDE",
+            ...apiKeyHeaders,
           },
         },
         proxyOptions
@@ -85,10 +98,11 @@ export async function getKiroUsage(accessToken, providerSpecificData, proxyOptio
           "Content-Type": "application/x-amz-json-1.0",
           "x-amz-target": "AmazonCodeWhispererService.GetUsageLimits",
           "Accept": "application/json",
+          ...apiKeyHeaders,
         },
         body: JSON.stringify({
           origin: "AI_EDITOR",
-          profileArn,
+          ...(profileArn ? { profileArn } : {}),
           resourceType: "AGENTIC_REQUEST",
         }),
       }, proxyOptions),
@@ -98,7 +112,7 @@ export async function getKiroUsage(accessToken, providerSpecificData, proxyOptio
       run: async () => {
         const params = new URLSearchParams({
           origin: "AI_EDITOR",
-          profileArn,
+          ...(profileArn ? { profileArn } : {}),
           resourceType: "AGENTIC_REQUEST",
         });
         return proxyAwareFetch(`${U("kiro").qHost}${U("kiro").limitsPath}?${params}`, {
@@ -106,6 +120,7 @@ export async function getKiroUsage(accessToken, providerSpecificData, proxyOptio
           headers: {
             "Authorization": `Bearer ${accessToken}`,
             "Accept": "application/json",
+            ...apiKeyHeaders,
           },
         }, proxyOptions);
       },