feat(grok-cli): add Grok CLI / Grok Build provider with OAuth device-code flow (#2502)

New OAuth provider routing through cli-chat-proxy.grok.com (OpenAI Responses
API), distinct from xai (api.x.ai) and grok-web (cookie SSO):

- Registry + GrokCliExecutor: Chat Completions -> Responses transform, CLI
  fingerprint headers, virtual effort models grok-4.5-{low,medium,high}
- OAuth device-code flow (auth.x.ai) with no-PKCE, shared xAI token refresh
- store=false multi-turn continuity via reasoning encrypted_content
- Quota tracker: on-demand window + prepaid balance on dashboard
- Connection test: 402 spending-limit = soft success (auth OK, out of credits)
- Alias/oauth/provider baselines + unit tests

tests/__baseline__/verify-oauth-urls.mjs

@@ -19,6 +19,8 @@ const resolved = {
     iflow: PROVIDERS.iflow?.tokenUrl,
     kiro: PROVIDERS.kiro?.tokenUrl,
     xai: PROVIDERS.xai?.tokenUrl,
+    // Grok CLI injects oauth.tokenUrl onto PROVIDERS via OAUTH_INJECT_FIELDS
+    "grok-cli": PROVIDERS["grok-cli"]?.tokenUrl,
     cline: PROVIDERS.cline?.tokenUrl,
     "kimi-coding": PROVIDERS["kimi-coding"]?.tokenUrl,
   },
@@ -31,6 +33,7 @@ const resolved = {
     cline: PROVIDERS.cline?.refreshUrl,
     "kimi-coding": PROVIDERS["kimi-coding"]?.refreshUrl,
     xai: PROVIDERS.xai?.refreshUrl,
+    "grok-cli": PROVIDERS["grok-cli"]?.tokenUrl,
   },
   clientIds: {
     claude: PROVIDERS.claude?.clientId,
@@ -38,6 +41,7 @@ const resolved = {
     qwen: PROVIDERS.qwen?.clientId,
     iflow: PROVIDERS.iflow?.clientId,
     "kimi-coding": PROVIDERS["kimi-coding"]?.clientId,
+    "grok-cli": PROVIDERS["grok-cli"]?.clientId,
   },
 };
 const current = JSON.parse(JSON.stringify(resolved));