refactor(open-sse): merge beta-url case + single-source refresh URLs (D)

buildUrl: fold kimi-coding into the shared ?beta=true case. refreshCline/
refreshKimiCoding now read URL (and kimi-coding clientId) from PROVIDERS instead
of hardcoded strings. Extend verify-oauth-urls with refresh/clientId snapshot;
URLs byte-for-byte equal, golden + gate clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/__baseline__/oauth-urls-baseline.json

@@ -40,5 +40,17 @@
     "qwen": "https://chat.qwen.ai/api/v1/oauth2/device/code",
     "iflow": "https://iflow.cn/oauth",
     "kiro": "https://prod.us-east-1.auth.desktop.kiro.dev"
+  },
+  "refreshUrls": {
+    "cline": "https://api.cline.bot/api/v1/auth/refresh",
+    "kimi-coding": "https://auth.kimi.com/api/oauth/token",
+    "xai": "https://auth.x.ai/oauth2/token"
+  },
+  "clientIds": {
+    "claude": "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+    "codex": "app_EMoamEEZ73f0CkXaXp7hrann",
+    "qwen": "f0304373b74a44d2b584a3fb70ca9e56",
+    "iflow": "10009311001",
+    "kimi-coding": "17e5f671-d194-4dfb-9706-5516cb48c098"
   }
 }