feat(quickstart): add subscription auth modes

[JordanTheJet]

Summary

• Base branch: master (all contributions)
• What changed and why:
  • Adds shared Quickstart auth_mode choices for OpenAI (api_key / codex) and Anthropic (api_key / setup_token) so users do not have to discover raw provider toggles.
  • Normalizes provider input aliases such as openai-codex, codex, claude, google, and grok to canonical config families during Quickstart apply.
  • Updates CLI, zerocode/TUI, and web Quickstart rendering so OpenAI Codex hides the API key row and writes the canonical OpenAI Responses auth config.
  • Documents OpenAI Codex subscription auth and Claude setup-token auth in the README and provider docs.
• Scope boundary: This PR configures the right provider/auth mode across surfaces; it does not run OAuth or setup-token commands inline during Quickstart.
• Blast radius: Quickstart provider selection/apply, TUI field-form navigation, web Quickstart provider form, provider auth help text, and docs.
• Linked issue(s): None.
• Labels: enhancement, provider, provider:openai, runtime, core, config, docs, quickstart

Validation Evidence (required)

Local validation is the signal CI cannot replace. Run the full battery and paste literal output (tails, failures, warnings — not "all passed").

cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test

Docs-only changes: replace with markdown lint + link-integrity (scripts/ci/docs_quality_gate.sh). Bootstrap scripts: add bash -n install.sh.

• Commands run and tail output:

cargo fmt --all -- --check

(no output; command exited 0)

cargo clippy --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 46.84s

cargo test

running 9 tests
test system::multi_agent_e2e::peer_group_routes_messages_only_within_resolved_peer_set ... ok
test system::multi_agent_e2e::peer_group_dotted_channel_refs_remain_alias_scoped_for_dispatch ... ok
test system::multi_agent_e2e::legacy_install_upgrades_cleanly_with_backup ... ok
test system::full_stack::system_simple_text_response ... ok
test system::full_stack::system_parallel_tool_execution ... ok
test system::full_stack::system_tool_execution_flow ... ok
test system::full_stack::system_multi_turn_conversation ... ok
test system::full_stack::system_tool_arguments_passed_correctly ... ok
test system::multi_agent_e2e::two_sqlite_agents_on_one_install_have_isolated_memory ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

   Doc-tests zeroclaw

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Additional focused checks run before the full battery:

cargo test -p zeroclaw-runtime quickstart::tests
# 22 passed; 0 failed

cargo test -p zerocode quickstart_pane::tests::openai_codex_auth_hides_api_key_row_in_tui_form
# 1 passed; 0 failed

cargo web check
# ==> npx tsc -b

• Beyond CI — what did you manually verify? Built release artifacts for manual testing before opening the PR: cargo web build, cargo build --release --locked, and cargo build --release --locked -p zerocode. Verified target/release/zeroclaw --version and target/release/zerocode --version both report 0.8.2.
• If any command was intentionally skipped, why: None.

Security & Privacy Impact (required)

Yes/No for each. Answer any Yes with a 1–2 sentence explanation.

• New permissions, capabilities, or file system access scope? (No)
• New external network calls? (No)
• Secrets / tokens / credentials handling changed? (Yes)
• PII, real identities, or personal data in diff, tests, fixtures, or docs? (No)
• If any Yes, describe the risk and mitigation: Quickstart now lets users select subscription auth modes and intentionally suppresses OpenAI API-key persistence for Codex auth. The canonical credential sources remain unchanged: OpenAI Codex still uses ZeroClaw auth profiles, and Anthropic setup tokens are saved through the existing provider credential field.

Compatibility (required)

• Backward compatible? (Yes)
• Config / env / CLI surface changed? (Yes)
• If No or Yes to either: Existing configs remain valid. New Quickstart submissions may use auth_mode = codex for OpenAI or auth_mode = setup_token for Anthropic; persisted config still uses canonical provider entries.

Rollback (required for medium/high-risk PRs)

Low-risk PRs: git revert <sha> is the plan unless otherwise noted.

Medium/high-risk PRs must fill:

• Fast rollback command/path: git revert 13d76066e
• Feature flags or config toggles: None.
• Observable failure symptoms: Quickstart provider creation errors, provider fields not appearing in CLI/TUI/web forms, or OpenAI Codex entries missing wire_api = "responses" / requires_openai_auth = true after Quickstart apply.

Supersede Attribution (required only when Supersedes # is used)

• Superseded PRs + authors (#<pr> by @<author>, one per line): N/A
• Scope materially carried forward: N/A
• Co-authored-by trailers added in commit messages for incorporated contributors? (No)
• If No, why (inspiration-only, no direct code/design carry-over): N/A