Add extensible OAuth providers

[TerminallyLazy]

Summary

• Refactors _oauth around a provider registry while keeping the existing Codex/ChatGPT flow available through an adapter.
• Adds GitHub Copilot OAuth with device-code login, model checking, proxy routing, refresh handling, and disconnect support.
• Adds xAI Grok OAuth with browser PKCE/manual callback handling, model checking, proxy routing, refresh handling, and disconnect support.
• Updates the _oauth settings UI, model provider metadata, docs, and regression tests for multi-provider operation.

Test plan

• PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -p no:cacheprovider tests/test_oauth_github_copilot.py tests/test_oauth_providers.py tests/test_oauth_xai_grok.py tests/test_oauth_static.py -q
• PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -p no:cacheprovider tests/test_plugin_scan_prompt.py -q
• pytest -q attempted locally; blocked during collection in this Homebrew Python 3.14 shell by missing/import-broken repo dependencies such as flask, litellm, simpleeval, httpx, pathspec, git, regex, and pytz.

Gemini OAuth is intentionally not included in this PR.

[3clyp50]

I added a commit with:

• Codex poll_device_login compatibility restored via account_id, while keeping account_label.
• UI provider cards driven from backend /status metadata instead of a hardcoded provider list.
• xAI browser callback completion observed from the modal via status polling.
• Structured usage-plan metadata for Codex, GitHub Copilot, Gemini API OAuth (the only one permitted by TOS), and xAI Grok.
• Merge conflict resolution against current upstream/ready, including the Codex hardening from recently merged PR Harden Codex OAuth refresh token ownership #1677.