feat(xai): add xAI Grok provider with OAuth + API key auth + image

Adapted from PR #1286 (mugnimaestra/feat/xai-grok-provider) to match
existing app architecture. Includes:

- OAuth 2.0 with PKCE on loopback port 56121 (Grok Build)
- API key auth path (console.x.ai)
- Token refresh wiring (open-sse + sse tokenRefresh)
- Dashboard OAuth modal with fixed-port flow + manual code fallback
- Provider registry entries (OAuth + API key)
- xAI image generation via OpenAI-compatible adapter
  (grok-2-image-1212 model, no size/quality/style params)

Excludes (intentionally, to match app patterns):
- Custom xAI Responses executor (DefaultExecutor handles /chat/completions)
- xAI-specific translators (app uses OpenAI as intermediate format)
- Image edits (not supported by current imageGenerationCore)
- Video endpoints (app has no video subsystem yet)
- CLI xai-login command

Refs decolua#1286

Co-authored-by: Cursor <cursoragent@cursor.com>

src/sse/services/auth.js

@@ -159,6 +159,7 @@ export async function getProviderCredentials(provider, excludeConnectionIds = nu
     const resolvedProxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {});
 
     return {
+      authType: connection.authType,
       apiKey: connection.apiKey,
       accessToken: connection.accessToken,
       refreshToken: connection.refreshToken,

src/sse/services/tokenRefresh.js

@@ -93,6 +93,13 @@ function toExpiresAt(expiresIn) {
   return new Date(Date.now() + expiresIn * 1000).toISOString();
 }
 
+function normalizeExpiresAt(expiresAt) {
+  if (!expiresAt) return null;
+  const date = new Date(expiresAt);
+  if (!Number.isFinite(date.getTime())) return null;
+  return date.toISOString();
+}
+
 /**
  * Providers that carry a real Google project ID.
  * @param {string} provider
@@ -154,6 +161,12 @@ export async function updateProviderCredentials(connectionId, newCredentials) {
     if (newCredentials.expiresIn) {
       updates.expiresAt = toExpiresAt(newCredentials.expiresIn);
       updates.expiresIn = newCredentials.expiresIn;
+    } else if (newCredentials.expiresAt) {
+      const expiresAt = normalizeExpiresAt(newCredentials.expiresAt);
+      if (expiresAt) {
+        updates.expiresAt = expiresAt;
+        updates.expiresIn = Math.max(1, Math.floor((new Date(expiresAt).getTime() - Date.now()) / 1000));
+      }
     }
     if (newCredentials.providerSpecificData) {
       updates.providerSpecificData = {
@@ -224,7 +237,7 @@ export async function checkAndRefreshToken(provider, credentials) {
             : creds.providerSpecificData,
           expiresAt:    newCreds.expiresIn
             ? toExpiresAt(newCreds.expiresIn)
-            : creds.expiresAt,
+            : normalizeExpiresAt(newCreds.expiresAt) || creds.expiresAt,
         };
 
         // Non-blocking: refresh projectId with the new access token