refactor(open-sse): P2 alias single-source — derive OAuth alias→id from OAUTH_ALIASES

- Export OAUTH_ALIASES as canonical id→alias source
- model.js derives 16 OAuth alias→id pairs instead of hardcoding (mmf kept out to preserve behavior)
- Add verify-alias.mjs byte-for-byte guard (133 tokens), all equal

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/config/providerModels.js

@@ -896,7 +896,8 @@ export function getModelQuotaFamily(aliasOrId, modelId) {
 }
 
 // OAuth providers that use short aliases (everything else: alias = id)
-const OAUTH_ALIASES = {
+// Single source of canonical id→alias; services/model.js derives the reverse.
+export const OAUTH_ALIASES = {
   claude: "cc",
   codex: "cx",
   "gemini-cli": "gc",