feat(coding-agent): add GLM ZCode OAuth login

[tmdgusya]

Summary

• add an opt-in, explicitly unofficial GLM ZCode OAuth builtin provider
• provision a scoped Z.AI API key for GLM-5.2 via the Anthropic-compatible endpoint
• reject malformed callback URLs and avoid echoing OAuth response bodies

Verification

• focused OAuth/provider tests passed in the primary workspace
• npx tsgo --noEmit passed
• Senpi CLI smoke 7/7 and Anthropic mock-loop 20/20 passed
• real source CLI --list-models includes glm-zcode glm-5.2
• full coding-agent suite: 4,461 passed; one unrelated app-server process-group test was flaky in the parallel full run and passed in isolation

Security note

The upstream ZCode flow has no verified PKCE support. The login flow labels itself unofficial, discloses that limitation, requires the exact zcode://oauth/callback redirect, validates state, and uses fixed service endpoints.

---

Summary by cubic

Adds an opt-in, unofficial glm-zcode OAuth provider to coding-agent. It lets users log in with ZCode and auto‑provisions a Z.AI API key to use GLM‑5.2 via the Anthropic‑compatible endpoint.

• New Features

  • Built-in glm-zcode provider using anthropic-messages at https://api.z.ai/api/anthropic; exposes glm-5.2 (reasoning, 1M context).
  • OAuth flow requires pasting the zcode://oauth/callback URL; exchanges via broker, then provisions a scoped Z.AI API key and returns it as access. Refresh reprovisions about every 55 minutes.
  • Registered in builtins and listed in AGENTS.md. Added tests for provisioning, refresh, and callback validation; updated registration-order tests.

• Security

  • Labeled unofficial and notes lack of PKCE support.
  • Enforces the exact zcode://oauth/callback redirect and validates state; rejects malformed callbacks.
  • Does not echo OAuth response bodies and uses fixed service endpoints.

^{Written for commit 7a391fb. Summary will update on new commits.}