feat(xiaomi-mimo): merge MiMo Desktop support into xiaomi-mimo as dual auth

Adds the Desktop-exclusive Preview models and the Xiaomi account-session
route to the existing xiaomi-mimo provider instead of a separate
xiaomi-desktop provider, so the dashboard shows one MiMo entry rather than
three overlapping ones.

Dual auth, same pattern as kimi — API key (sk-) covers the cloud API,
Desktop/OAuth adds the account session used by the Preview models:

- registry: category oauth, authModes [oauth, apikey], oauth block, the two
  mimo-x-*-preview models, and the invite signupUrl
- executor: routes Preview models to the account-service route with a Cookie
  session, everything else keeps the sourceFormat-matched transport
- oauth: custom ECDH encrypted-callback flow (X25519 -> SHA256 -> AES-256-GCM)
  with a loopback callback proxy, plus one-click import of the local Desktop
  auth.json
- usage: weekly quota from the account session

Fixes found while merging:

- the OAuth browser flow was dead: poll-status cleared the session before the
  client could POST /exchange, so every exchange returned 400
- a Claude-format client was sent to /v1/chat/completions instead of the
  declared /anthropic/v1/messages transport, because buildUrl ignored
  runtimeTransport
- stopXiaomiMimoProxy leaked every pending session (each holding an X25519
  private key) for the process lifetime
- the OAuth exchange did not persist the Desktop passToken, so the Preview
  models could never work after a browser sign-in

Removes dead code: the local engine token minting (mimoEngine, never called
on the request path), the model-catalog and usage routes, engineToken/
engineUrl plumbing, and an unread top-level usage block.

Adds tests/unit/xiaomi-mimo-{executor,oauth-session,oauth-proxy}.test.js —
the provider previously had none.

tests/unit/xiaomi-mimo-oauth-proxy.test.js

@@ -0,0 +1,54 @@
+/**
+ * Regression: the xiaomi-mimo OAuth session store must not retain sessions
+ * once the callback listener is down.
+ *
+ * Each /authorize registers a session holding an X25519 private key, keyed by a
+ * fresh state. Unlike trae/windsurf/zed (singleton session) this is a Map, so
+ * without an explicit clear every login attempt would leak a private key for
+ * the whole process lifetime.
+ */
+import { describe, it, expect } from "vitest";
+import {
+  registerXiaomiMimoSession,
+  getXiaomiMimoSessionStatus,
+  clearXiaomiMimoSession,
+  stopXiaomiMimoProxy,
+} from "../../src/lib/oauth/utils/server.js";
+
+const KEY = Buffer.from("x25519-private-key-material");
+
+describe("xiaomi-mimo OAuth session store", () => {
+  it("drops pending sessions when the proxy stops", () => {
+    registerXiaomiMimoSession({ state: "s1", privateKeyDer: KEY });
+    expect(getXiaomiMimoSessionStatus("s1")).not.toBeNull();
+
+    stopXiaomiMimoProxy();
+
+    expect(getXiaomiMimoSessionStatus("s1")).toBeNull();
+  });
+
+  it("drops every session, not just the last one", () => {
+    registerXiaomiMimoSession({ state: "a", privateKeyDer: KEY });
+    registerXiaomiMimoSession({ state: "b", privateKeyDer: KEY });
+    registerXiaomiMimoSession({ state: "c", privateKeyDer: KEY });
+
+    stopXiaomiMimoProxy();
+
+    for (const s of ["a", "b", "c"]) {
+      expect(getXiaomiMimoSessionStatus(s)).toBeNull();
+    }
+  });
+
+  it("ignores registrations with a missing state or key", () => {
+    expect(registerXiaomiMimoSession({ state: "", privateKeyDer: KEY })).toBe(false);
+    expect(registerXiaomiMimoSession({ state: "s", privateKeyDer: null })).toBe(false);
+  });
+
+  it("never exposes the private key to callers", () => {
+    registerXiaomiMimoSession({ state: "s1", privateKeyDer: KEY });
+    const view = getXiaomiMimoSessionStatus("s1");
+    expect(view).toEqual({ status: "pending", result: null, error: null });
+    expect(JSON.stringify(view)).not.toContain("privateKeyDer");
+    clearXiaomiMimoSession("s1");
+  });
+});