feat: add Qoder OAuth, price-source selection, and Claude inspection

[Circumsized]

Summary

Adds Qoder OAuth management, selectable model-price sources, catalog input/output modality display, and Manager Server-backed read-only Claude OAuth inspection.

Draft — not ready to merge. Pre-submission verification identified the provider-isolation and translation blockers below. Backend/runtime verification and complete UI evidence are also outstanding.

Scope

• Frontend panel
• Manager Server
• CPA panel mode
• Full Docker mode
• Native packages / release
• Docs / Wiki
• CI / build / tooling (local tooling ignores only; no workflow changes)

Changes

• Add Qoder device-code login, authorization-link handling, auth-status polling, reauthorization mapping, provider labels/icons, and demo handling. Report an upgrade hint when the connected CPA lacks the start endpoint.
• Add default ordered fallback or explicit models.dev, LiteLLM, or OpenRouter price sync. Explicit selection does not silently fall back. Restrict production fetches to trusted hosts and public addresses with DNS-pinned transport and redirect checks.
• Display explicit catalog input/output modalities from synchronized models.dev/OpenRouter metadata. This does not infer actual request media-token usage or introduce new multimodal billing rules.
• Add server Claude OAuth usage probing through CPA's management API-call envelope, keeping Claude outcomes read-only and rejecting server-side credential mutations. Normalize the server-side anthropic alias and retain unsupported providers without a probe.
• Update English/Chinese documentation and related locale strings; ignore local tooling artifacts.

Four feature commits: 7dba3d2, bdacfdc, 5d9b8e7, 65c18ff. Two inherited main-promotion commits add ancestry but no additional three-dot PR diff content. Local merge-tree check against dev at 61d7962 completed without conflicts; no rebase or merge was applied.

User Impact

Compatible CPA deployments gain a Qoder login entry. Manager Server users can select price-catalog sources, see advertised model modalities, and configure read-only Claude quota inspection. The draft blockers must be resolved before shipping these changes.

Compatibility / Runtime Notes

• CPA panel mode: continues using direct CPA management APIs. Qoder depends on a compatible upstream CPA endpoint. Browser-local inspection is intended to support Codex/xAI only; the stale-settings isolation gap below remains unresolved.
• Manager Server mode: provides price sync/catalog storage and Claude inspection. Claude requests use GET https://api.anthropic.com/api/oauth/usage through CPA /v0/management/api-call.
• Full Docker / native packages: share Manager Server behavior; no packaging/install changes. End-to-end verification of these deployment modes was not performed locally.
• Qwen/Qoder/iFlow are not newly supported inspection targets.

Data / Security Notes

Claude server probes use authIndex and the upstream-injected Bearer $TOKEN$ placeholder. The new server path retains accounts and does not enable delete/disable/enable/reauth or auto-recovery for Claude. No credentials or runtime data are included in this PR.

The pre-push security scan did not produce a complete result (scanner_enobufs); this is not a passing security assessment. No complete audit is claimed.

Known blockers before ready-for-review

• Provider isolation: CodexInspectionPage.tsx:219-225 reloads browser-local settings with the generic persisted-settings loader, overriding the local-only initializer. codexInspection.ts also generic-normalizes session settings and dispatches every non-xAI selected account to the Codex probe at :551-555. Persisted/crafted Claude target settings can therefore select a Claude account and invoke the wrong provider probe instead of failing closed. No real upstream effects or credential leakage were tested. Fix the local/session dispatch boundary and add an integration regression test. Preserve the existing localStorage merge: the new local loader currently reads config only.
• Translations: the four monitoring.codex_inspection_target_claude labels used by InspectionConfigFields.tsx are absent from all four locale JSON files.
• Complete backend CI, mode-specific manual checks, and usable screenshots/recordings before marking ready.

Risk / Rollback

Risk level: High until the browser-local provider-isolation blocker is resolved; otherwise this spans provider workflows and server outbound catalog fetching.

Rollback notes: this PR has not been merged or deployed. Keep it draft. If later deployed, restore the previous application build and disable Claude inspection before rollback; retain existing data backups.

Verification

• Type check
• Lint (0 errors; one warning in unchanged AccountHealthBadge.tsx)
• Tests (focused frontend and architecture pass; docs integrity has one local failure; backend/full suite not run)
• Build (production and demo bundles)
• Manual UI check (limited demo DOM smoke check only; real CPA/Full Docker flows not exercised)
• Docs/link check (docs build succeeds; content-integrity test caveat below)
• Not applicable, docs-only

Commands / evidence, rerun against 65c18ff on Windows:

npm run type-check                                     PASS
npm run lint                                           PASS, 1 warning
npm run build                                          PASS
npm run check:demo-isolation                            PASS
npm --workspace apps/web run build:demo:bundle           PASS
npm run docs:build                                     PASS
npm --workspace apps/web run test -- <12 focused files>  PASS, 352 tests
npm exec -- vitest run tests/frontendArchitectureBoundaries.test.mjs
                                                       PASS, 1 test
npm exec -- vitest run tests/docsContentIntegrity.test.mjs
                                                       6 passed, 1 failed
git diff --check upstream/dev...HEAD                    PASS
git merge-tree --write-tree --name-only upstream/dev HEAD
                                                       PASS, no conflicts

The 12 focused files are OAuthPage.test.tsx, services/api/oauth.test.ts, accountReauth.test.ts, demoApi.authFiles.test.ts, sourceDisplay.test.ts, utils/usage.test.ts, usageService.modelPrices.test.ts, modelPricesPageModel.test.ts, codexInspection.test.ts, InspectionConfigFields.test.tsx, and both local/server CodexInspectionPage lifecycle suites.

The docs failure is at tests/docsContentIntegrity.test.mjs:200: a literal LF-only regex for the collapsed Advanced Configuration group does not match the Windows CRLF working-tree config. git ls-files --eol confirms CRLF; neither that test nor apps/docs/.vitepress/config.ts differs from upstream/dev. No line-ending or test change was made to conceal the failure. Documentation build completed successfully.

Go is unavailable on this host, so Go tests, race tests, and backend execution were not run. The full frontend/repository suite was not rerun in this submission pass. Focused passing tests do not cover the provider-isolation blocker above.

Screenshots / Recordings

Pending usable review artifacts. A local demo DOM check confirmed the Qoder OAuth card and start-login button. The browser capture was not suitable as complete visual evidence; no real login was initiated. Price-source, modality, Claude settings, and deployment-mode visual checks remain outstanding.

Docs

• README / README_CN updated for user-visible capabilities
• Matching docs manual and navigation updated (manuals updated; navigation/label completeness still needs review)
• Demo fixtures, screenshots, and deep links reviewed (demo handling/tests/build checked; visual evidence incomplete)
• Release notes needed
• Not needed — explanation included below

Docs decision: document Qoder's upstream dependency, Manager Server-only capabilities, and the distinction between catalog metadata and measured billing. Resolve remaining label/navigation gaps before release.

Related

N/A