feat(oauth): zed/trae/windsurf providers + harden callback proxies

- zed live model discovery; codebuddy-intl handler; remove duplicate workbuddy
- split oauth providers.js into per-provider files (facade re-export)
- fold 5 standard refresh providers into config-driven generic
- hide trae/windsurf from registry (no tool calling support)
- fix login-CSRF + SSRF on trae/windsurf/zed local callback proxies
  via loopback-origin guard + strict state validation + apiOrigins allowlist
- move zed RSA private key transit to POST body; redact proxy logs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

open-sse/providers/registry/index.js

@@ -100,10 +100,11 @@ import p97 from "./xiaomi-tokenplan.js";
 import p98 from "./youcom.js";
 import p99 from "./alims-intl.js";
 import p100 from "./codebuddy-intl.js";
-import p101 from "./workbuddy.js";
-import p102 from "./trae.js";
+// Temporarily hidden — no tool calling support (trae SOLO agent / windsurf gRPC skip ToolCallChunk).
+// Re-enable by uncommenting both the import and the array entry below.
+// import p102 from "./trae.js";
 import p103 from "./zed.js";
-import p104 from "./windsurf.js";
+// import p104 from "./windsurf.js";
 
 export default [
   p0,
@@ -207,8 +208,7 @@ export default [
   p98,
   p99,
   p100,
-  p101,
-  p102,
+  // p102, // trae — hidden, no tool calling
   p103,
-  p104,
+  // p104, // windsurf — hidden, no tool calling
 ];