Add provider-specific token account routing

[Finesssee]

Summary

Adds provider-specific token-account routing for Kimi, Doubao, and OpenCode Go using the existing shared account model.

• Kimi kimi-auth accounts force the regional web route, isolate the selected cookie from API credentials, and fail closed without ambient fallback.
• Doubao Ark accounts use only the selected key and do not fall back to ambient credentials.
• OpenCode Go distinguishes API-key and Cookie accounts, preserves saved source settings, and rejects explicit Web or CLI sources for an API-key account to avoid reporting a different identity.
• Preserves selected credentials through Tauri fetch-context construction so the selected-account routes compile.

This draft stacks on #619 (codex/port-0.65-provider-pack).

Validation

• On the first commit, Rust account tests passed (153 passed, 1 ignored), and the Kimi selected-session rejection test passed.
• After the routing and ownership fixes: cargo fmt --all -- --check and git diff --check passed; deterministic routing coverage was added.
• The newest regression tests and Tauri shell tests were not run locally because free disk is below 35 GiB. Hosted validation is pending.

No frontend/UI files changed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Thermo review finding — P2, blocking approval:

Provider/account source routing for Kimi, Doubao, and OpenCode Go is duplicated between build_fetch_context in commands/providers.rs and project_token_account in rust/src/cli/usage/fetch_helpers.rs. Those independent matches can drift, causing the tray and CLI to route the same selected account differently.

Please move the provider/account/source decision into one small shared policy helper in the Rust core, while leaving shell and CLI settings/account selection in their current owners. Cover Kimi cookie → Web, Doubao API key → OAuth, OpenCode Go Cookie + Auto → Web, and OpenCode Go API-key Auto/OAuth plus explicit Web/CLI rejection.