feat(qoder): port Kiro-style provider integration with COSY signing

Replaces the Qoder placeholder with a real free-tier provider:

- Device-flow OAuth: PKCE + nonce generated locally, user authorizes at
  qoder.com/device/selectAccounts, poll openapi.qoder.sh until token
- COSY signing (RSA-1024 + AES-128-CBC + MD5) for chat / model-list
- WAF-bypass body encoding (custom-alphabet base64 + thirds rearrange)
- Live model_config catalog from /algo/api/v2/model/list, cached 1h
- 11 models registered (auto/ultimate/performance/efficient/lite +
  6 frontier *model ids)
- Usage fetcher for openapi.qoder.sh/api/v2/quota/usage
- Dashboard live-models resolver, provider test, OAuth modal hookup
- 24 unit tests covering encoder, PKCE, COSY headers, sigPath stripping

open-sse/config/providers.js

@@ -94,13 +94,13 @@ export const PROVIDERS = {
     authUrl: "https://iflow.cn/oauth"
   },
   qoder: {
-    baseUrl: "https://api.qoder.com/v1/chat/completions",
+    // The qoder executor builds the full URL itself (it has to append
+    // ?Encode=1 + sigPath query params and bypass any provider-level URL
+    // rewriting). baseUrl is kept for compatibility with introspection
+    // helpers but the executor ignores it.
+    baseUrl: "https://api3.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation",
     format: "openai",
-    headers: { "User-Agent": "Qoder-Cli" },
-    clientId: process.env.QODER_OAUTH_CLIENT_ID || "10009311001",
-    clientSecret: process.env.QODER_OAUTH_CLIENT_SECRET || "4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW",
-    tokenUrl: "https://api.qoder.com/oauth/token",
-    authUrl: "https://qoder.com/oauth/authorize"
+    headers: {},
   },
   antigravity: {
     baseUrls: [