Proposal: xAI device-code auth for X Premium / SuperGrok in Models/Providers

[sdiviney]

Background

xAI recently announced subscription-backed Grok access for OpenClaw via X Premium / SuperGrok, with a device-code flow intended for headless / VPS / remote setups:

• xAI announcement: https://x.ai/news/grok-openclaw
• OpenClaw xAI provider docs: https://docs.openclaw.ai/providers/xai

The current OpenClaw xAI provider page documents xAI API-key, OAuth, and device-code auth paths, including:

openclaw onboard --auth-choice xai-device-code
openclaw models auth login --provider xai --device-code

xAI subscription auth isn't reachable from the AlphaClaw Models/Provider Authentication UI.

Proposal

I'd like to open a narrowly scoped PR that adds xAI device-code auth to the post-setup Models/Provider Authentication UI, modeled on the existing Codex OAuth section:

• POST /api/xai/device-code/start and /poll, plus /status and /disconnect, written directly in lib/server/routes/xai.js (no shelling out to the OpenClaw CLI).
• Store the result as a new auth profile alongside xai:default; don't overwrite or remove the API-key path.
• Add a X Premium / SuperGrok section to the xAI provider card with connect / reconnect / disconnect controls.
• Tests for route behavior, profile persistence, and polling failure states (authorization_pending, slow_down, access_denied, expired_token, malformed/network errors).

OpenClaw owns token refresh, so AlphaClaw just needs to write a correctly shaped OAuth profile (access, refresh, finite expires) into the shared auth-profiles.json.

Out of scope for this PR

• First-run onboarding changes.
• xAI browser OAuth / PKCE.

Both can follow as separate PRs if useful. Can adjust if you'd prefer a different approach.