feat: deferred 0.44/0.45 ports (aiand, serve LAN auth, soft-remove)

[Finesssee]

Summary

Ports remaining deferred upstream items onto Win-CodexBar:

1. ai& (aiand) provider (upstream 0.45 Add ai& spend provider steipete/CodexBar#2256) — spend-only API-key provider
2. CLI serve token-gate + LAN host (upstream 0.44 Token-gated dashboard snapshots for codexbar serve (restart of #1026) steipete/CodexBar#2227)
3. Soft-remove Kimi K2 + CrossModel (upstream Remove Kimi K2 and CrossModel provider relays steipete/CodexBar#2254)

Changes

ai& provider

• GET https://api.aiand.com/logs?range=30days&limit=100 with Bearer AIAND_API_KEY
• Paginate up to 10 pages via after / after_id
• Sum same-currency cost rows → CostSnapshot period Last 30 days / Last 30 days (partial)
• Informational primary RateWindow (UsageSnapshot requires primary)
• Wired: ProviderId::AiAnd, factory, token accounts, api_keys, desktop icons/catalog/tray/ProvidersTab
• Icon from upstream ProviderIcon-aiand.svg

serve LAN auth

• --host (default 127.0.0.1), --dashboard-token / CODEXBAR_DASHBOARD_TOKEN, --allow-plain-http
• Non-loopback requires token + --allow-plain-http
• Gate /usage and /cost with Authorization: Bearer (SHA-256 constant-time compare)
• /health always open; Host header allows loopback + configured bind host

Soft-remove

• ProviderId::is_deprecated() for KimiK2 and CrossModel
• Display names include (removed)
• Settings catalog hides them unless already enabled
• CLI still resolves --provider kimik2 / crossmodel

Tests

cargo test --manifest-path rust/Cargo.toml --lib -- aiand serve::tests provider_id deprecated every_provider_id api_key_provider_catalog

32 passed. Desktop crate cargo check clean.

Not included

• No version bump / packaging

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

This repository allows each user to open at most 4 pull requests per 7 days.

Closing this automatically.