Add Z.ai provider and optional API key for openai-compatible endpoints

[moa234-SK]

Summary

This PR makes openai-compatible endpoints reach hosted services. It adds a dedicated Z.ai provider, optional API-key authentication, and version-aware model-listing paths.

What changed

1. Dedicated zai provider (a93b45f)

• Adds the zai provider type. It targets https://api.z.ai/api/coding/paas/v4 and serves the GLM models.
• The plugin sends the API key as a Bearer token. It suppresses Z.ai reasoning content with the ZaiThinking dialect.
• OpenAiCompatibleEndpoint.FromBaseUrl now detects a trailing version segment. A base like .../v4 no longer gets another /v1 appended.

2. Optional API key for openai-compatible (0d1e703)

• A new EndpointOrApiKeyAuth shape declares two methods: None and ApiKey. None stays the default, so local endpoints behave as before.
• The init wizard shows an auth picker. The ApiKey path adds an endpoint step and a required key step before the probe.
• The provider manager TUI adds endpoint-then-key stages for add and fix flows. A declared ApiKey entry without a stored key is blocked before persistence.
• Doctor fails loudly when an entry declares AuthMethod: ApiKey but secrets.json stores no key.
• Keys persist to secrets.json in encrypted form (ENC:). The netclaw-operations skill documents the new flow (version 2.57.0).

3. Version-aware probe path (989084c)

• OpenAiCompatibleDescriptor.ProbeAsync resolves the listing path through the new OpenAiCompatibleEndpoint.RelativeModelsPath.
• A versioned base probes <base>/models. An unversioned base probes <base>/v1/models.
• This fixes a 404 for hosted bases such as api.z.ai/api/coding/paas/v4 and inference.hetzner.com/api.

Why

Operators could not add hosted keyed OpenAI-compatible endpoints before. The generic type only served local no-auth endpoints. The dedicated Z.ai type covers its reasoning dialect; the generic type covers LiteLLM, Hetzner, and other gateways.

Testing

• New suites: OpenAiCompatibleAuthTests (23 tests, with a headless typed-key end-to-end flow), 2 doctor tests, ZaiProviderTests (240 lines), and endpoint path tests.
• Full suites pass: Daemon 1047/1047; Cli 1400 passed, 2 environment skips.
• Smoke tape index comments updated for the new type order.
• Not run on this host: run-evals.sh (needs eval credentials) and native smoke (Linux-only harness).

OpenSpec

• openspec/changes/add-zai-provider/ — artifacts included, complete.
• openspec/changes/add-openai-compatible-auth/ — artifacts included, complete; sync and archive after merge.