Core: Vault subscription-backed LLM providers (use your plan)

[ReBoticsAI]

Summary

Add Vault cards for subscription-backed inference (monthly/plan quota pays, not metered Platform API rates), alongside the existing Cursor subscription card. Cloud onboarding already promises BYOK; Vault should make "Use your plan" first-class for any inference provider that bills the subscription.

Providers in scope

Auth may be OAuth, device code, or a subscription-scoped API key (same UX goal as Cursor):

• Cursor (already shipped; keep as reference)
• GitHub Copilot (device code / OAuth / Copilot SDK)
• ChatGPT Plus/Pro/Team via Codex OAuth (grey ToS; per-user tokens only, no pooling)
• GitLab Duo (OAuth; Premium/Ultimate + Duo Agent Platform)
• OpenCode Go / Zen (API key after signup)
• Z.AI GLM Coding Plan (coding-plan key, not payg)
• xAI SuperGrok / X Premium with Grok API (OAuth preferred; console key is metered)
• DigitalOcean Inference (account OAuth / routers)
• Snowflake Cortex (browser OAuth / PAT)
• Kimi Code (Kimi membership / Code Console key; not Moonshot payg)
• MiniMax Token Plan (subscription key; not MiniMax payg)
• Poe (subscription compute points API)
• Amazon Q Developer / Kiro (AWS Builder ID / product auth; optional later if auth complexity is acceptable)

Out of scope (do not treat as subscription)

• Claude Pro/Max OAuth (forbidden for third parties)
• Gemini Advanced / Google AI Ultra consumer OAuth (same class of restriction)
• Perplexity Pro/Max as a full API substitute (app sub is not Sonar API)
• Metered Platform keys (tracked in the companion API-keys issue)

Acceptance

• Vault has a clear Subscriptions section (or equivalent cards)
• At least Cursor remains; additional providers land incrementally with working auth + model routing into Intelligence
• SaaS onboarding copy matches what Vault actually supports
• Per-tenant credentials only; no shared/pooled consumer subscription tokens on Cloud
• Document ToS/grey providers (esp. ChatGPT Codex) in operator notes

Related

Companion: metered API-key BYOK providers (see linked issue).

[ReBoticsAI]

Companion API-key BYOK issue: #231

[ReBoticsAI]

Harness requirement for new subscription backends: #232 (profiles keyed by backend/transport, not model id alone).