Add xAI Grok subscription OAuth

[pridemusvaire]

Summary

• Operators can connect SuperGrok / eligible X Premium+ via xAI device-code OAuth from Settings → Models and the setup inference step (alongside the existing XAI_API_KEY path).
• Tokens are stored encrypted on the control plane; public status and poll responses never return access/refresh tokens.
• Inference gateway xai-oauth strategy prefers a refreshed OAuth bearer for xai/ models and falls back to XAI_API_KEY when only the key is configured.

Test plan

• Unit tests for device-code start/poll success and failure, encrypted status (no tokens), refresh safety margin, disconnect
• Gateway tests: OAuth bearer preferred, API-key fallback, disconnected fail-closed
• Catalog/status flags: xaiSubscriptionConnected / xaiApiKeyConnected
• check-types:fast + lint + knip via pre-push
• Manual device-code connect with a SuperGrok account (no live credentials in CI)

[roomote-roomote]

Review blocked: the fork source branch could not be fetched in this checkout, so the current head cannot be verified against repository context. See task

• apps/web/src/components/settings/XaiConnectDialog.tsx:80: Cancelling and quickly reopening the dialog can leave the first poll loop alive. Once the second flow sets the shared ref back to true, the old loop resumes and can save its old device code's account, replacing the account the operator intended to connect. Use a per-flow cancellation token or verify the active device code before each poll/result.

_{Reviewed 17fc504}