feat(oauth): zed/trae/windsurf providers + harden callback proxies

- zed live model discovery; codebuddy-intl handler; remove duplicate workbuddy
- split oauth providers.js into per-provider files (facade re-export)
- fold 5 standard refresh providers into config-driven generic
- hide trae/windsurf from registry (no tool calling support)
- fix login-CSRF + SSRF on trae/windsurf/zed local callback proxies
  via loopback-origin guard + strict state validation + apiOrigins allowlist
- move zed RSA private key transit to POST body; redact proxy logs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/lib/oauth/providers/github.js

@@ -0,0 +1,98 @@
+import { GITHUB_CONFIG } from "../constants/oauth.js";
+
+const github = {
+  config: GITHUB_CONFIG,
+  flowType: "device_code",
+  requestDeviceCode: async (config) => {
+    const response = await fetch(config.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        scope: config.scopes,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Device code request failed: ${error}`);
+    }
+
+    return await response.json();
+  },
+  pollToken: async (config, deviceCode) => {
+    const response = await fetch(config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+
+    // Handle response properly - if not ok, try to get error as text first
+    let data;
+    try {
+      data = await response.json();
+    } catch (e) {
+      // If response is not JSON, get as text
+      const text = await response.text();
+      data = { error: "invalid_response", error_description: text };
+    }
+
+    return {
+      ok: response.ok,
+      data: data,
+    };
+  },
+  postExchange: async (tokens) => {
+    // Get Copilot token using GitHub access token
+    const copilotRes = await fetch(GITHUB_CONFIG.copilotTokenUrl, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`,
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+    const copilotToken = copilotRes.ok ? await copilotRes.json() : {};
+
+    // Get user info from GitHub
+    const userRes = await fetch(GITHUB_CONFIG.userInfoUrl, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`,
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+    const userInfo = userRes.ok ? await userRes.json() : {};
+
+    return { copilotToken, userInfo };
+  },
+  mapTokens: (tokens, extra) => ({
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresIn: tokens.expires_in,
+    name: extra?.userInfo?.login || extra?.userInfo?.name,
+    displayName: extra?.userInfo?.name || extra?.userInfo?.login,
+    email: extra?.userInfo?.email || null,
+    providerSpecificData: {
+      copilotToken: extra?.copilotToken?.token,
+      copilotTokenExpiresAt: extra?.copilotToken?.expires_at,
+      githubUserId: extra?.userInfo?.id,
+      githubLogin: extra?.userInfo?.login,
+      githubName: extra?.userInfo?.name,
+      githubEmail: extra?.userInfo?.email,
+    },
+  }),
+};
+
+export default github;