Transition OpenCode Zen into OpenCode Console with dual authentication

[grikomsn]

Summary

Transitions OpenCode Zen into OpenCode Console, matching upstream's consolidation of the standalone Zen gateway into the Console (provider id opencode, two auth methods: device-code Console account + "API key (service account)"), and adds Console device-code sign-in for Go.

Zen → Console

• The opencodezen vendor and zen mode are removed. Former Zen models now live in the OpenCode Console group, still served by https://opencode.ai/zen/v1 (upstream retains the historical URL path).
• opencode.defaultMode and opencode.inlineSuggestionsGateway accept only console/go; persisted zen values are normalized to console at read time.
• Stored Zen API keys in opencode.apiKeys.v1 are migrated to the console slot on first read (and the blob is rewritten to the new shape).
• Pre-Console usage scopes (zen:*) are migrated to console:* snapshots.

Dual authentication for Console and Go

• Both providers accept a service-account API key (native entry, or command sign-in) and the Console device-code flow, mirroring upstream's two registered methods.
• Key credentials take precedence over device-flow sessions; force-refresh on HTTP 401 still resolves through the session.
• Key-credential Console catalogs load the shared public /models discovery with free-only filtering; device-code profiles keep organization-scoped /api/config discovery with x-org-id (never cached publicly, never falling back to public lists).
• Go device sign-in stores a shared Console session (subscriptions are managed in the Console); Go sign-out deliberately preserves it.

Catalog refresh

• Verified live against both /models endpoints (85 Console / 43 Go ids) and models.dev.
• New supplemental mirrors for discovery-only ids: Console jev-1.13, jev-1.13-free; Go mimo-v2-pro, mimo-v2-omni, omen-alpha (canonical models.dev entries supersede once cataloged; no guessed pricing).
• qwen3.8-max is live on Console again; alias/deprecated filtering behavior unchanged.

Branding and docs

• Manifest (two provider groups, Console entry now takes an optional secret apiKey plus profile), commands, diagnostics, README, and docs/{setup,models,security}.md updated; no endpoint or protocol changes beyond mode consolidation.

Validation

• npm test — 150 passing (includes new migration, key-precedence, Go device-credential, gateway-normalization, and catalog-cache tests)
• npm run package — VSIX builds cleanly
• npx changeset status — minor bump registered for opencode-bridge-copilot-chat

Notes

• No changeset for the vendored zen display strings that remain intentionally: URL paths (/zen/v1) are upstream-owned, and legacy-value handling is documented in the settings descriptions.