fix(cliproxy): mark Kiro as device_code flow for dashboard auth

CLIProxyAPIPlus uses device code flow for Kiro authentication, returning
{method: "device_code", state, status} without an immediate URL. The URL
is provided via polling the /get-auth-status endpoint.

Previously, Kiro was configured as authorization_code flow, causing
dashboard auth to fail with "No authorization URL received from CLIProxyAPI"
because the web-server routes expected synchronous URL response.

Changes:
- provider-capabilities.ts: kiro.oauthFlow = 'device_code', callbackPort = null
- provider-config.ts: Add 'kiro' to DEVICE_CODE_PROVIDERS array
- provider-capabilities.test.ts: Update test expectations

This routes Kiro through /start endpoint which properly handles device code
flow via WebSocket events (deviceCodeReceived, deviceCodeCompleted, etc).

Closes #552

src/cliproxy/provider-capabilities.ts

@@ -46,8 +46,8 @@ export const PROVIDER_CAPABILITIES: Record<CLIProxyProvider, ProviderCapabilitie
   },
   kiro: {
     displayName: 'Kiro (AWS)',
-    oauthFlow: 'authorization_code',
-    callbackPort: 9876,
+    oauthFlow: 'device_code',
+    callbackPort: null,
     aliases: ['codewhisperer'],
   },
   ghcp: {

tests/unit/cliproxy/provider-capabilities.test.ts

@@ -30,13 +30,12 @@ describe('provider-capabilities', () => {
   });
 
   it('returns providers by OAuth flow capability', () => {
-    expect(getProvidersByOAuthFlow('device_code')).toEqual(['qwen', 'ghcp']);
+    expect(getProvidersByOAuthFlow('device_code')).toEqual(['qwen', 'kiro', 'ghcp']);
     expect(getProvidersByOAuthFlow('authorization_code')).toEqual([
       'gemini',
       'codex',
       'agy',
       'iflow',
-      'kiro',
       'claude',
     ]);
   });
@@ -53,6 +52,7 @@ describe('provider-capabilities', () => {
 
   it('exposes callback port and display name capabilities', () => {
     expect(getOAuthCallbackPort('qwen')).toBeNull();
+    expect(getOAuthCallbackPort('kiro')).toBeNull();
     expect(getOAuthCallbackPort('gemini')).toBe(8085);
     expect(getProviderDisplayName('agy')).toBe('AntiGravity');
   });

ui/src/lib/provider-config.ts

@@ -76,7 +76,7 @@ export function getProviderDisplayName(provider: string): string {
  * Providers that use Device Code OAuth flow instead of Authorization Code flow.
  * Device Code flow requires displaying a user code for manual entry at provider's website.
  */
-export const DEVICE_CODE_PROVIDERS: CLIProxyProvider[] = ['ghcp', 'qwen'];
+export const DEVICE_CODE_PROVIDERS: CLIProxyProvider[] = ['ghcp', 'kiro', 'qwen'];
 
 /** Check if provider uses Device Code flow */
 export function isDeviceCodeProvider(provider: string): boolean {