feat(coding-agent): add GLM ZCode OAuth login

[tmdgusya]

Summary

• add an opt-in, explicitly unofficial GLM ZCode OAuth builtin provider
• provision a scoped Z.AI API key for GLM-5.2 via the Anthropic-compatible endpoint
• reject malformed callback URLs and avoid echoing OAuth response bodies

Verification

• focused OAuth/provider tests passed in the primary workspace
• npx tsgo --noEmit passed
• Senpi CLI smoke 7/7 and Anthropic mock-loop 20/20 passed
• real source CLI --list-models includes glm-zcode glm-5.2
• full coding-agent suite: 4,461 passed; one unrelated app-server process-group test was flaky in the parallel full run and passed in isolation

Security note

The upstream ZCode flow has no verified PKCE support. The login flow labels itself unofficial, discloses that limitation, requires the exact zcode://oauth/callback redirect, validates state, and uses fixed service endpoints.

---

Summary by cubic

Adds an opt-in, unofficial glm-zcode OAuth provider to coding-agent. It lets users log in with ZCode and auto‑provisions a Z.AI API key to use glm-5.2 via the Anthropic‑compatible endpoint.

• New Features

  • Built-in glm-zcode provider using anthropic-messages at https://api.z.ai/api/anthropic; sends ZCode headers; exposes glm-5.2 (reasoning, 1M context).
  • OAuth flow: paste the zcode://oauth/callback URL; exchanges via broker, provisions a scoped Z.AI API key, and returns it as access. Refresh reprovisions about every 55 minutes.
  • Registered in built-ins and listed in AGENTS.md. Added tests for provisioning, refresh, and callback validation; updated registration‑order tests.

• Security

  • Unofficial login; PKCE not verified and disclosed in the UI.
  • Enforces the exact zcode://oauth/callback redirect and state validation; rejects malformed callbacks before exchange.
  • Uses fixed service endpoints and avoids echoing OAuth response bodies.

^{Written for commit 2009c65. Summary will update on new commits.}