[feature]: support startup xAI quota with expired OAuth access token

[H-TTTTT]

Pre-flight checks

• I searched existing issues and did not find a duplicate request.
• I reviewed current behavior on the production released OpenCode version.

OpenCode version reviewed

1.18.4

Problem statement

The xAI quota provider on main@2a6b919 intentionally treats OpenCode as the sole owner of OAuth refresh and auth.json persistence. It reads the latest xAI OAuth entry directly, which correctly picks up tokens refreshed by OpenCode.

However, if the stored xAI access token expires before the first xAI model request in a new OpenCode session, startup/sidebar quota collection cannot display the SuperGrok meter. It reports:

xAI OAuth token expired; use xAI in OpenCode to refresh it or reconnect xAI

After an xAI model request, OpenCode refreshes and persists the token; the next quota query succeeds. This means startup quota works only after using xAI once.

Reproduction:

1. Connect xAI with SuperGrok OAuth.
2. Let the access token expire without making another xAI model request.
3. Restart OpenCode or run opencode-quota show --provider xai.
4. Observe the expired-token error instead of the quota meter.
5. Send one xAI model request, then repeat the quota query; it succeeds.

Proposed change

Provide a maintainer-approved path for the quota provider to obtain a fresh xAI access token at startup while preserving OpenCode as the credential owner. Prefer one of these approaches:

• an OpenCode client/API operation that asks the provider auth plugin to refresh and persist its credential; or
• an OpenCode-authenticated request path that performs provider-owned refresh before the billing request.

The quota plugin should then re-read the updated xAI credential and query the existing billing endpoint. It should not duplicate OAuth refresh logic or write auth.json directly unless that ownership model is explicitly accepted.

Alternatives considered

• Direct refresh and auth.json writes inside opencode-quota were prototyped in closed PR fix(provider): refresh xAI OAuth for startup quota #180. That approach was not pursued because it duplicates OpenCode OAuth logic and can race with rotating refresh tokens or concurrent auth-file updates.
• Requiring one xAI model request works today, but defeats startup quota display.
• Reconnecting xAI works but is unnecessary when the refresh token remains valid.

Acceptance criteria

• An expired xAI access token with a valid refresh token can yield quota at startup without a preceding xAI model request.
• OpenCode remains the authoritative OAuth refresher and credential writer.
• Rotating refresh tokens and concurrent requests do not trigger duplicate refreshes.
• OPENCODE_AUTH_CONTENT remains read-only.
• No access or refresh token is exposed in logs, errors, diagnostics, or tests.
• Existing xAI quota and expired-token tests are updated for the accepted architecture.

[slkiser]

@H-TTTTT Happy to implement, would appreciate feedback on #182 and the other features/PRs added for xAI.

[slkiser]

Oh I just learned that xAI uses refresh token rotation.... so race condition is going to cause someone to need to run /connect again for xAI in OpenCode