feat(xai): add xAI Grok provider with OAuth + API key auth + image

Adapted from PR #1286 (mugnimaestra/feat/xai-grok-provider) to match
existing app architecture. Includes:

- OAuth 2.0 with PKCE on loopback port 56121 (Grok Build)
- API key auth path (console.x.ai)
- Token refresh wiring (open-sse + sse tokenRefresh)
- Dashboard OAuth modal with fixed-port flow + manual code fallback
- Provider registry entries (OAuth + API key)
- xAI image generation via OpenAI-compatible adapter
  (grok-2-image-1212 model, no size/quality/style params)

Excludes (intentionally, to match app patterns):
- Custom xAI Responses executor (DefaultExecutor handles /chat/completions)
- xAI-specific translators (app uses OpenAI as intermediate format)
- Image edits (not supported by current imageGenerationCore)
- Video endpoints (app has no video subsystem yet)
- CLI xai-login command

Refs decolua#1286

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/xai-tokenRefresh.test.js

@@ -0,0 +1,63 @@
+import { describe, it, expect, vi } from "vitest";
+
+// We can't easily import the open-sse switch logic without real PROVIDERS config,
+// so verify the wrapper function shape directly via dynamic import.
+
+describe("xai/token-refresh wrapper", () => {
+  it("refreshXaiToken module loads without throwing", async () => {
+    // Just verify the file imports cleanly. The actual wrapper is internal.
+    const mod = await import("../../open-sse/services/tokenRefresh.js");
+    expect(typeof mod.refreshTokenByProvider).toBe("function");
+    expect(typeof mod.formatProviderCredentials).toBe("function");
+  });
+
+  it("formatProviderCredentials returns Bearer-shape for xai", async () => {
+    const mod = await import("../../open-sse/services/tokenRefresh.js");
+    const out = mod.formatProviderCredentials(
+      "xai",
+      { apiKey: "k", accessToken: "t", refreshToken: "r" },
+      null
+    );
+    expect(out).toEqual({ apiKey: "k", accessToken: "t" });
+  });
+
+  it("refreshTokenByProvider returns null when refreshToken missing", async () => {
+    const mod = await import("../../open-sse/services/tokenRefresh.js");
+    const out = await mod.refreshTokenByProvider("xai", { refreshToken: "" }, null);
+    expect(out).toBeNull();
+  });
+
+  it("refreshTokenByProvider returns expiresIn for refreshed xai tokens", async () => {
+    vi.resetModules();
+    vi.doMock("../../src/lib/oauth/services/xai.js", () => ({
+      XaiService: class {
+        async refreshAccessToken(refreshToken) {
+          return {
+            access_token: "new-access",
+            refresh_token: `${refreshToken}-rotated`,
+            expires_in: 900,
+            id_token: "id-token",
+          };
+        }
+      },
+    }));
+
+    const mod = await import("../../open-sse/services/tokenRefresh.js");
+    const out = await mod.refreshTokenByProvider(
+      "xai",
+      { refreshToken: "old-refresh" },
+      null
+    );
+
+    expect(out).toEqual({
+      accessToken: "new-access",
+      refreshToken: "old-refresh-rotated",
+      expiresIn: 900,
+      idToken: "id-token",
+    });
+    expect(out).not.toHaveProperty("expiresAt");
+
+    vi.doUnmock("../../src/lib/oauth/services/xai.js");
+    vi.resetModules();
+  });
+});