refactor(open-sse): P2 alias single-source — derive OAuth alias→id from OAUTH_ALIASES

- Export OAUTH_ALIASES as canonical id→alias source
- model.js derives 16 OAuth alias→id pairs instead of hardcoding (mmf kept out to preserve behavior)
- Add verify-alias.mjs byte-for-byte guard (133 tokens), all equal

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/config/providerModels.js

@@ -896,7 +896,8 @@ export function getModelQuotaFamily(aliasOrId, modelId) {
 }
 
 // OAuth providers that use short aliases (everything else: alias = id)
-const OAUTH_ALIASES = {
+// Single source of canonical id→alias; services/model.js derives the reverse.
+export const OAUTH_ALIASES = {
   claude: "cc",
   codex: "cx",
   "gemini-cli": "gc",

open-sse/services/model.js

@@ -1,20 +1,16 @@
-// Provider alias to ID mapping
+import { OAUTH_ALIASES } from "../config/providerModels.js";
+
+// Reverse OAuth aliases (id→alias) into alias→id; "mmf" intentionally excluded to preserve behavior
+const OAUTH_ALIAS_TO_ID = Object.fromEntries(
+  Object.entries(OAUTH_ALIASES)
+    .filter(([id]) => id !== "mimo-free")
+    .map(([id, alias]) => [alias, id])
+);
+
+// Provider alias to ID mapping (OAuth short aliases derived above)
 const ALIAS_TO_PROVIDER_ID = {
-  cc: "claude",
-  cx: "codex",
-  gc: "gemini-cli",
-  qw: "qwen",
-  if: "iflow",
-  ag: "antigravity",
-  gh: "github",
-  kr: "kiro",
-  cu: "cursor",
-  kc: "kilocode",
-  kmc: "kimi-coding",
-  cl: "cline",
-  oc: "opencode",
+  ...OAUTH_ALIAS_TO_ID,
   ocg: "opencode-go",
-  qd: "qoder",
   qoder: "qoder",
   // TTS providers
   el: "elevenlabs",