feat(kiro): add external_idp CLIProxyAPI import for Microsoft SSO

Import Kiro accounts authenticated via Microsoft Entra/365 SSO using
CLIProxyAPI JSON. Adds external_idp refresh path (form-encoded OAuth2,
Microsoft login host allowlist), TokenType: EXTERNAL_IDP header for
runtime and usage/quota requests, dashboard import UI, and unit tests.
Scoped to authMethod === "external_idp"; existing Kiro auth unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/oauth/kiro/import-cli-proxy/route.js

@@ -0,0 +1,40 @@
+import { NextResponse } from "next/server";
+import { createProviderConnection } from "@/models";
+import { normalizeKiroExternalIdpAuth } from "@/lib/oauth/kiroExternalIdp";
+
+/**
+ * POST /api/oauth/kiro/import-cli-proxy
+ * Import Kiro CLIProxyAPI auth JSON for Microsoft external_idp accounts.
+ */
+export async function POST(request) {
+  try {
+    const body = await request.json();
+    const rawAuth = body?.cliProxyAuth ?? body?.auth ?? body?.json ?? body;
+    const tokenData = normalizeKiroExternalIdpAuth(rawAuth);
+
+    const connection = await createProviderConnection({
+      provider: "kiro",
+      authType: "oauth",
+      accessToken: tokenData.accessToken,
+      refreshToken: tokenData.refreshToken,
+      expiresAt: tokenData.expiresAt,
+      email: tokenData.email || null,
+      providerSpecificData: tokenData.providerSpecificData,
+      testStatus: "active",
+    });
+
+    return NextResponse.json({
+      success: true,
+      connection: {
+        id: connection.id,
+        provider: connection.provider,
+        email: connection.email,
+      },
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: error?.message || "CLIProxyAPI import failed" },
+      { status: 400 }
+    );
+  }
+}