fix(ai): isolate and align subscription provider requests

[bobleer]

Summary

Subscription imports could retain stale authentication headers, use the wrong protocol for an account model, or omit request affinity on standalone calls. Resolve these rules from the signed-in provider and attach an explicit subscription identity to runtime clients. Ordinary API-key clients keep their existing routing, custom headers, request bodies, and editor controls, even when pointed at the same provider URLs.

• OpenCode imports select Go/Zen and models; the authenticated account catalog selects each model's wire format. Standalone calls generate an opaque x-opencode-session identity once per logical call and retain it across retries.
• Align Hermes models, including anthropic/*, with its current Chat Completions default; preserve the Nous refresh-header contract and existing credentials.
• Apply account-owned authentication and attribution headers despite legacy custom-header replace mode or casing. Scope Codex body requirements and Codex/OpenCode/xAI affinity to explicit subscription clients and matching trusted origins.
• Invalidate cached subscription clients on credential revision changes, and apply the same subscription profile to desktop initialization and transient connection/discovery clients.

Type and Areas

Type: bug fix

Areas: AI adapters, Rust client factory, desktop/Tauri, Web UI model settings, documentation.

Motivation / Impact

Users can import subscription models without manually choosing transport protocols or supplying account headers. Login, refresh, account switching, and logout update the runtime configuration without rewriting saved credentials or model IDs. API-key clients do not opt into subscription policy through URL matching.

Verification

Automated checks completed on macOS:

• cargo test -p openbitfun-ai-adapters --features subscription-auth --lib — 362 passed.
• cargo test --locked -p openbitfun-ai-adapters --features subscription-auth --lib subscription_auth — 79 passed. The Hermes refresh request test also passes alone with --exact, using the production HTTP client constructor to initialize TLS independently of test order.
• cargo test -p openbitfun-ai-adapters --lib providers:: — 60 passed, including ordinary API requests at subscription origins.
• cargo test -p openbitfun-core --no-default-features --features ai-adapter-runtime,subscription-auth --lib infrastructure::ai::client_factory::tests — 9 passed; rerun after updating the branch to upstream c88b25fa5.
• cargo test -p openbitfun-core --no-default-features --features ai-adapter-runtime --lib infrastructure::ai::client_factory::tests — 8 passed.
• cargo check -p openbitfun-desktop — passed.
• cargo test -p openbitfun-desktop --lib — 430 passed, 7 ignored.
• pnpm --dir src/web-ui run test:run src/infrastructure/config/components/modelDiscoveryCoordinator.test.ts src/infrastructure/config/components/subscriptionLoginCoordinator.test.ts — 12 passed; rerun after updating the upstream base.
• pnpm run check:web and pnpm --dir src/web-ui run type-check — passed.
• pnpm run fmt:rs, git diff --check, and node scripts/check-git-object-sizes.mjs --base upstream/main --head HEAD — passed.

Other checks above were completed before incorporating the two non-overlapping upstream merges. Regression coverage includes legacy credential/config deserialization, credential round trips, stale account cache invalidation, per-request affinity, standalone retries, provider/origin isolation, and API-key custom-header/body preservation.

Reviewer Notes

AI-assisted contribution. Testing level: lightly tested end to end, with the automated coverage above. Real account login/refresh/inference and live remote workspace, remote control, Peer Device Mode, and Detached Dispatch scenarios were not exercised. Local fixtures do not establish remote behavior. Account-backed UI screenshots were not captured.

Protocol comparisons are documented in the adapter guide against OpenCode v1.18.29 and Hermes Agent. No persisted schema or remote wire contract is added. Unknown legacy OpenCode models retain their previous route; required subscription overrides remain runtime-only.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.