Fix xAI OAuth subscription transport routing

[shizhenwei1984-cell]

Summary

• Route the built-in xai provider through the Grok CLI subscription endpoint only when authMode is oauth.
• Preserve the existing api.x.ai transport for API-key authentication.
• Apply the same auth-mode-aware transport selection to live model discovery.
• Add regression coverage for OAuth inference, OAuth model discovery, API-key isolation, custom providers, and header overrides.

Why

The xAI preset accepts both OAuth and API-key credentials, but both modes currently share https://api.x.ai/v1. A valid Grok subscription OAuth token is therefore evaluated against API-team spend limits and can receive HTTP 429 with an RPM limit of 0/0, even while subscription quota is available.

The same OAuth token succeeds against https://cli-chat-proxy.grok.com/v1 with the Grok CLI client markers. This change keeps the persisted preset compatible with the dashboard's "Use an API key instead" switch and resolves the effective transport at request time, so the two billing surfaces cannot silently cross.

Closes #112.

Verification

• bun run typecheck
• bun test tests/xai-transport.test.ts tests/provider-live-models.test.ts tests/provider-quota.test.ts tests/openai-chat-hardening.test.ts — 20 passed
• bun run test
• bun run privacy:scan
• bun run build:gui
• npm pack --dry-run
• Installed the packed fork into an isolated runtime and ran a real Codex/OpenCodex xai/grok-4.5 structured-output smoke: upstream HTTP 200, reported usage, zero retry/correction, canonical output valid, VM advanced successfully.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were reviewed; the README already documents xAI as oauth / key, so no user-facing text change is required.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.