refactor(providers): unify xAI authentication entry point

[backryun]

Summary

• present xAI API-key and OAuth setup through one xai dashboard card
• keep xai-oauth/xao as backend compatibility IDs for OAuth refresh, quota, and existing stored connections
• co-locate both registry entries under registry/xai/ and remove the duplicate registry/xai-oauth/ module
• include every xAI auth variant in connection listing, card stats/toggles, and batch connection tests

Validation

• node --import tsx/esm --test tests/unit/provider-connections-fetch-url-2998.test.ts tests/unit/providers-page-utils.test.ts tests/unit/alibaba-provider-regions.test.ts tests/unit/xai-oauth-provider.test.ts tests/unit/xai-oauth-test-supported.test.ts — 50/50 pass
• npm run typecheck:core — pass
• targeted ESLint for all changed files — pass
• git diff --check — pass

Existing release-base blockers

• dashboard typecheck and the focused Vitest UI suite stop on the pre-existing missing closing brace in src/shared/components/modelSelectModalHelpers.ts (TS1005 / parser EOF)
• npm run check:file-size reports six existing files outside this diff
• tests/unit/providers-constants-split.test.ts still hard-codes 198 API-key entries while the release base currently exports 227; this PR does not add a provider entry

[backryun]

This PR depends on #10195. #10195 must be merged before #10201 can be completed. Once #10195 is merged, please complete #10201 while preserving as much context as possible from the Grok-related work in #10195—especially the model list/catalog entries—so that those model-list changes are retained rather than lost or replaced.

[diegosouzapw]

The xAI auth unification is solid: 36 node tests + 6 vitest pass on this branch, the OAuth client id is correctly routed through resolvePublicCred (Hard Rule #11), and oauthProviderId propagates through resolveStaticProviderCatalogEntry into the dashboard card so the OAuth modal targets the xai-oauth backend while the card is unified under xai.

One coordination note: this PR and #10195 (Grok 4.6 / DeepSeek) have a modify/delete conflict on open-sse/config/providers/registry/xai-oauth/index.ts — this PR deletes the module (co-locating the OAuth entry into registry/xai/index.ts), while #10195 edits it to add targetFormat: "openai-responses" to the Grok 4.5 entry. The resolution is trivial (fold that one targetFormat line into the co-located OAuth block in registry/xai/index.ts), but whichever PR lands second must rebase. Suggest landing this one first, or coordinating the merge order. Otherwise the diff is clean and fully tested — no other blocking findings.

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #8875. Mergify cannot evaluate rules on this PR. Once #8875 is merged or closed, Mergify will resume processing this PR. ⚠️

[backryun]

Restored after an accidental auto-close. During a routine branch refresh (rebase onto the updated base), this branch was mistakenly pushed as a flat copy of release/v3.8.50. That left the PR with zero changed files, so GitHub auto-closed it — nothing was intentionally withdrawn.

The branch is now properly rebased onto the current base (c62ace5a4):

• Full change set intact: 16 files, +162/−52, identical in scope to the original patch.
• The one real conflict (src/shared/constants/providers/apikey/frontier-labs.ts — base added serviceKinds: ["llm", "imageToText"] to the xAI entry in feat(providers): declare imageToText serviceKind on major vision providers #10275 while this PR adds dual-auth metadata at the same spot) was resolved by keeping both sides.

CI is re-running on the restored head. Sorry for the noise.

[diegosouzapw]

Validated in local merge-train .claude/worktrees/merge-train-20260816-000002-suite.log on devbox-vm-06-dev002 @ 8be62df65f61cc4cf29cdc3e6bc38173ffafa4e3 (FAST gates green: static + changed tests + vitest; daily full-suite run still required). Merged under the batch merge-train protocol (merge-gates §7). ⚠️ base-red inherited: #10523 (ServiceSupervisor order-dependent test, not touched by this batch).