feat: M4 文风 + M5 生成/多provider/Skill + Kimi Code 订阅接入 + 本地联调修复

M4（文风）: style-auditor 双轨（提取指纹/漂移第四审）+ jobs 长任务框架(zombie reaper) + 回炉 refine + GET /style read-back。
M5（生成+扩展）: worldbuilder/character-gen（入库 continuity 409 gate + partition_writes 白名单 + schema→JSONB 形变）；
  网关多 provider 回退链/熔断/能力降级（Anthropic/Gemini 适配器）；Skill registry + 表权限沙箱 + 规则；
  前端 角色生成器/世界观/Codex/规则页/技能库/⌘K 命令面板。
K1（Kimi Code 订阅接入）: OAuth device-flow（kimi-code）+ 静态 Console key（kimi-code-key）两路径；
  coding 端点 KimiCLI 伪造头（实测 UA allow-list 门禁，缺则 403）+ JSON 模式结构化（thinking ⊥ tool_choice）。
本地联调修复: CORS 中间件；assemble 注入 premise+「写第N章」指令（修空 prompt 400）；
  GET /outline·/draft read-back + 大纲/工作台/审稿页重载；写页 client/server 常量边界 + notFound 健壮化；
  字数 toLocaleString locale 水合；审稿页终稿从已存草稿 seed（修 accept 422）。
门禁: backend ruff/mypy(157)/alembic 无漂移/pytest 451 · frontend lint/tsc/vitest/build。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/ww_api/services/credentials.py

@@ -20,12 +20,24 @@ from ww_llm_gateway.adapters.base import Capabilities
 STUB_OWNER_ID = uuid.UUID(int=1)
 
 
+# 凭据认证类型（`provider_credentials.auth_type`，见 C2 扩 K1.1）。
+AUTH_TYPE_API_KEY = "api_key"
+AUTH_TYPE_OAUTH = "oauth"
+
+
 @dataclass(frozen=True)
 class StoredCredential:
-    """存储层视图：含密文，绝不出 API 边界（路由仅取 provider 并掩码）。"""
+    """存储层视图：含密文，绝不出 API 边界（路由仅取 provider 并掩码）。
+
+    一行二选一：`auth_type="api_key"` → `api_key_enc` 有值、`oauth_enc=None`；
+    `auth_type="oauth"`（Kimi Code device-flow，K1.3）→ `oauth_enc` 有值、`api_key_enc=None`
+    （持 Fernet 加密的 `{access_token,refresh_token,expires_at}` JSON 包）。
+    """
 
     provider: str
-    api_key_enc: bytes
+    api_key_enc: bytes | None
+    auth_type: str = AUTH_TYPE_API_KEY
+    oauth_enc: bytes | None = None
 
 
 @dataclass(frozen=True)
@@ -51,6 +63,12 @@ class CredentialStore(Protocol):
         self, owner_id: uuid.UUID, provider: str, api_key_enc: bytes
     ) -> None: ...
 
+    async def upsert_oauth_credential(
+        self, owner_id: uuid.UUID, provider: str, oauth_enc: bytes
+    ) -> None: ...
+
+    async def delete_credential(self, owner_id: uuid.UUID, provider: str) -> bool: ...
+
     async def upsert_routing(self, routing: StoredRouting) -> None: ...
 
 
@@ -72,7 +90,15 @@ class SqlCredentialStore:
                 select(ProviderCredential).where(ProviderCredential.owner_id == owner_id)
             )
         ).scalars()
-        return [StoredCredential(provider=r.provider, api_key_enc=r.api_key_enc) for r in rows]
+        return [
+            StoredCredential(
+                provider=r.provider,
+                api_key_enc=r.api_key_enc,
+                auth_type=r.auth_type,
+                oauth_enc=r.oauth_enc,
+            )
+            for r in rows
+        ]
 
     async def list_routing(self) -> list[StoredRouting]:
         rows = (await self._session.execute(select(TierRouting))).scalars()
@@ -94,7 +120,12 @@ class SqlCredentialStore:
         ).scalar_one_or_none()
         if row is None:
             return None
-        return StoredCredential(provider=row.provider, api_key_enc=row.api_key_enc)
+        return StoredCredential(
+            provider=row.provider,
+            api_key_enc=row.api_key_enc,
+            auth_type=row.auth_type,
+            oauth_enc=row.oauth_enc,
+        )
 
     async def upsert_credential(
         self, owner_id: uuid.UUID, provider: str, api_key_enc: bytes
@@ -117,12 +148,68 @@ class SqlCredentialStore:
                     project_id=None,
                     provider=provider,
                     api_key_enc=api_key_enc,
+                    auth_type=AUTH_TYPE_API_KEY,
+                    oauth_enc=None,
                 )
             )
         else:
             existing.api_key_enc = api_key_enc
+            existing.auth_type = AUTH_TYPE_API_KEY
+            existing.oauth_enc = None
         await self._session.commit()
 
+    async def upsert_oauth_credential(
+        self, owner_id: uuid.UUID, provider: str, oauth_enc: bytes
+    ) -> None:
+        """写/更新 OAuth 凭据行（Kimi Code device-flow，K1.3）。
+
+        `auth_type="oauth"`、`oauth_enc=<Fernet 加密 token 包>`、`api_key_enc=None`。
+        显式 read-modify-write（同 `upsert_credential`：含可空 project_id 的唯一约束不能用
+        PG `ON CONFLICT`，见 memory/gotchas）。明文 token 绝不进此层（已加密）。
+        """
+        existing = (
+            await self._session.execute(
+                select(ProviderCredential).where(
+                    ProviderCredential.owner_id == owner_id,
+                    ProviderCredential.project_id.is_(None),
+                    ProviderCredential.provider == provider,
+                )
+            )
+        ).scalar_one_or_none()
+        if existing is None:
+            self._session.add(
+                ProviderCredential(
+                    owner_id=owner_id,
+                    project_id=None,
+                    provider=provider,
+                    api_key_enc=None,
+                    auth_type=AUTH_TYPE_OAUTH,
+                    oauth_enc=oauth_enc,
+                )
+            )
+        else:
+            existing.api_key_enc = None
+            existing.auth_type = AUTH_TYPE_OAUTH
+            existing.oauth_enc = oauth_enc
+        await self._session.commit()
+
+    async def delete_credential(self, owner_id: uuid.UUID, provider: str) -> bool:
+        """删除凭据行（OAuth disconnect / 撤销）。返回是否删到行。"""
+        existing = (
+            await self._session.execute(
+                select(ProviderCredential).where(
+                    ProviderCredential.owner_id == owner_id,
+                    ProviderCredential.project_id.is_(None),
+                    ProviderCredential.provider == provider,
+                )
+            )
+        ).scalar_one_or_none()
+        if existing is None:
+            return False
+        await self._session.delete(existing)
+        await self._session.commit()
+        return True
+
     async def upsert_routing(self, routing: StoredRouting) -> None:
         existing = (
             await self._session.execute(