feat(providers): add MiniMax Global and CN OAuth

[jellyjelly814]

Summary

Add first-class MiniMax Token Plan OAuth support for both Global and CN regions.

This change adds:

• minimax_global and minimax_cn provider entries with curated MiniMax-M3 and M2.7 models.
• OAuth 2.0 device authorization with PKCE S256 and strict state validation.
• The shared MiniMax public client ID coding-plan-cli with the openid profile coding_plan scope.
• Region-specific OAuth and Anthropic-compatible API endpoints.
• Proactive access-token refresh with a five-minute buffer, cross-process locking, transient retry handling, and atomic refresh-token persistence.
• Separate Global and CN credential files, isolated from existing Codex OAuth storage.
• Runtime token refresh and MiniMax authentication headers for both normal and streaming requests.
• CLI login commands, onboarding, provider status/test/reset support, TUI setup detection, and model-picker entries.
• English and Chinese documentation updates.

Public model references remain under minimax-global/ and minimax-cn/. The runtime translates them to the Anthropic-compatible LiteLLM route only when sending a request, so provider selection continues to use the correct MiniMax OAuth credential.

The implementation accepts MiniMax expiry values expressed as relative seconds, Unix epoch seconds, or Unix epoch milliseconds. OAuth-returned verification and resource URLs are restricted to the expected HTTPS hosts before use.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• uv run pytest tests/test_minimax_oauth.py tests/test_cli_provider_commands.py tests/test_provider_catalog.py tests/test_config_update_providers.py tests/test_tui_rpc_model.py tests/test_tui_rpc_setup.py tests/test_cli_status_commands.py -q -x - 143 passed.

• Focused MiniMax onboarding tests - 3 passed.

• uv run ruff check raven tests - passed.

• uv run ruff format --check raven tests - 761 files already formatted.

• make check-large-files - passed.

• make check-commits - passed.

• Two independent read-only reviews completed; the final review found no blocking issues.

• The full test collection was not run because the local environment does not include the optional dingtalk_stream channel dependency. All provider, OAuth, onboarding, TUI setup, status, and configuration tests relevant to this change passed.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

Risk

• OAuth credentials are stored in region-specific files with restrictive permissions and atomic replacement.

• Refresh operations use a cross-process lock and persist rotated refresh tokens before exposing them to the runtime.

• OAuth verification and API resource URLs are validated against region-specific host allowlists.

• Existing minimax API-key configuration remains unchanged; the new OAuth providers use separate slugs and storage.

• Rollback consists of reverting this change. Existing API-key provider configuration and credentials are not migrated or modified.

• Security impact considered

• Backward compatibility considered

• Rollback path is clear for risky changes

Related Issues

N/A

• Live OAuth smoke test: MiniMax Global MiniMax-M3 returned "MiniMax OAuth works" successfully after normalizing the Anthropic-compatible resource URL.