feat(volcengine): Ark plan providers + phone/SMS console auto-login

[rengaryang]

Adds first-class support for Volcano Engine Ark subscription plans (Coding Plan & Agent Plan), including a session-based headless phone+SMS login for the console so binding a plan no longer requires a manual browser on the server.

What

• Two new providers: volcengine-coding-plan and volcengine-agent-plan — registry entries, capability-seeded catalogs, and console API binding that detects plan availability, extracts the plan API key (ListApiKeys/GetRawApiKey), and upserts the connection with live quota usage.
• Live model discovery from the console: Coding Plan via ListArkCodeLatestModel, Agent Plan via ListAgentPlanLatestModel. Discovered models merge into the synced catalog; the static registry stays as an offline capability-seed fallback (deliberately not in CURATED_MODEL_ONLY_PROVIDERS).
• Phone + SMS auto-login (headless, session-based): POST /api/providers/volcengine-plan/connect {phone} opens a headless Playwright context, switches to the 手机号登录 tab, fills the phone, and requests the SMS code. Sub-routes /code, /status, /resend, /cancel, and /identity complete the flow. The service handles the console's MFA step-up modal (需要额外认证 — a second SMS code), the identity-selection page (/auth/login/select_identity, scraped with the real selectors from the auth bundle: ul[class*=accountUl] li[class*=accountLi] + button[type=submit]), and image captcha (screenshot returned to the dashboard for manual entry). Risk-control sliders or the TOTP-binding modal degrade to the existing headful manual flow instead of hanging.
• New VolcengineConnectModal on the provider page walks through phone → code → MFA → identity → bound, with resend countdown and per-step status.
• Security: every new route stays behind the LOCAL_ONLY + spawn-capable deny-lists (the connect pattern widened to connect(/.*)? to cover the session sub-routes); the phone number is kept in memory only.

Validation

• 32 new unit tests for the auto-login state machine (MFA step-up, identity selection, resend cooldown, bind dedupe + no-retry-on-failure, timeout diagnostics) — all pass.
• Regression: 73/73 across the volcengine suite, authz route guards, and token extraction configs. typecheck:core clean, open-sse typecheck gate OK (within baseline), ESLint clean.
• One test adaptation: the new "-web" naming lint in tokenExtractionConfig.test.ts exempts volcengine-console (it extracts a console session cookie, not a chat-web credential).

Generated with OmniRoute 🚀

[diegosouzapw]

Thanks for a substantial, well-tested feature — landed via consolidated batch validation (direct push — your rengar/main fork branch's history had diverged massively from this repo's main/release/v3.8.50 since your fork point: the diff against the current tip showed 100 commits and ~600K changed lines, almost all of it already-shipped, unrelated history your fork never synced. Identified your 6 genuinely new commits (b1a00c20..48004d13) and cherry-picked exactly those onto the current release tip — a clean 31-file, +4211/-2 diff). Adds first-class Volcano Engine Ark plan support: two new providers (volcengine-coding-plan, volcengine-agent-plan), live model discovery, and headless phone/SMS console auto-login with MFA/identity-selection/captcha handling, kept behind the LOCAL_ONLY spawn-capable deny-lists. Own regression suite (72/72, including the full auto-login state-machine coverage) passes + typecheck:core clean. Thanks for the careful attention to security scoping here!