feat: xAI OAuth (SuperGrok + X Premium) — grok-build-0.1 model + web_search via X.com #402

Summary

Implement OAuth-based authentication for xAI (SuperGrok / X Premium) subscribers in Zoo Code, enabling access to the grok-build-0.1 coding model and a web_search tool backed by X.com's search infrastructure — complementing the existing API-key based xAI provider.

Motivation

Zoo Code currently supports xAI via API-key auth in src/api/providers/xai.ts pointing at https://api.x.ai/v1. However, several capabilities are gated behind xAI subscriptions (SuperGrok / X Premium) and are not accessible through standard API keys:

1. grok-build-0.1 — xAI's purpose-built coding model optimized for agentic code generation. Currently only available via third-party proxies.
2. Web search via X.com — SuperGrok/X Premium subscribers can search the web through X.com's search infrastructure, but there is no native web_search tool contract mapped in Zoo Code's xAI handler.
3. SuperGrok / X Premium tier detection — The existing API-key auth cannot distinguish between free-tier, SuperGrok, and X Premium subscription levels, limiting model availability and feature gating.

Proposed Implementation

1. OAuth Flow for xAI

Add a new OAuth authentication flow using VS Code's SecretStorage (same mechanism used by src/services/zoo-code-auth.ts):

• Authorization Code Flow with PKCE — Standard OAuth 2.0 pattern for desktop/CLI apps
• xAI OAuth endpoints — https://x.ai/oauth/authorize and https://api.x.ai/v1/oauth/token (to be confirmed from xAI's OAuth docs)
• Token storage — Store refresh + access tokens in VS Code SecretStorage (key pattern: xai-oauth-token)
• Token refresh — Implement automatic refresh_token exchange on 401 responses

2. Provider Registration

• Register the OAuth-based provider alongside the existing API-key provider in src/api/providers/index.ts
• Either extend src/api/providers/xai.ts with OAuth support or create a new variant

3. Model Additions

Add to packages/types/src/providers/xai.ts:

• grok-build-0.1 — Coding-optimized model with appropriate maxTokens, context window, and tool support
• Ensure search_replace is included and apply_diff is excluded (consistent with existing xAI model configs)

4. Web Search Tool

Add a web_search tool capability that:

• Uses X.com's search infrastructure (authenticated via SuperGrok/X Premium OAuth tokens)
• Returns structured search results (titles, URLs, snippets)
• Is conditionally available based on detected subscription tier

5. Subscription Tier Detection

Implement post-OAuth tier detection to distinguish between:

• Free tier — Basic Grok access only
• SuperGrok — Full access to grok-build-0.1 + web search
• X Premium — Access via X.com subscription (may have different rate limits)

This can be done by checking the token's scopes or calling a userinfo/entitlements endpoint after successful auth.

Affected Files (Proposed)

Out of Scope

• Browser-automation based cookie auth
• OAuth for X/Twitter API v2 (this is specifically about xAI's model access OAuth for Grok)