feat(models): add Z.AI (GLM) credential integration and setup flow

Implement first-class Z.AI credential storage and authentication:

- New auth provider: src/auth/zai.ts for Z.AI API key management
- New CLI command: flynn zai-auth to store Z.AI API keys
- New TUI command: /login zai for interactive credential entry
- Modified src/auth/index.ts to register zai provider
- Modified src/cli/index.ts to register zai-auth command
- Modified src/cli/setup/providers.ts to include Z.AI in setup wizard
- Modified src/daemon/models.ts to support zhipuai use_oauth flag
- Modified src/daemon/clientFactory.test.ts to add Z.AI tests
- Modified src/frontends/tui/commands.ts to add login command
- Modified src/frontends/tui/minimal.ts to support credential prompts

This allows users to authenticate with Z.AI (GLM models) without
embedding secrets in config files. Credentials are stored securely in
~/.config/flynn/auth.json and resolved at runtime.

Updated state.json with new feature entry documenting the integration.

src/daemon/clientFactory.test.ts

@@ -105,6 +105,26 @@ describe('createClientFromConfig', () => {
     expect(client).toBeInstanceOf(OpenAIClient);
   });
 
+  it('creates OpenAIClient for zhipuai when use_oauth is enabled and ZAI_API_KEY is set', () => {
+    const prev = process.env.ZAI_API_KEY;
+    process.env.ZAI_API_KEY = 'zai-api-key';
+
+    try {
+      const client = createClientFromConfig({
+        provider: 'zhipuai',
+        model: 'glm-4.7',
+        use_oauth: true,
+      });
+      expect(client).toBeInstanceOf(OpenAIClient);
+    } finally {
+      if (prev === undefined) {
+        delete process.env.ZAI_API_KEY;
+      } else {
+        process.env.ZAI_API_KEY = prev;
+      }
+    }
+  });
+
   it('creates OpenAIClient for zhipuai using ZHIPUAI_AUTH_TOKEN env var', () => {
     const prev = process.env.ZHIPUAI_AUTH_TOKEN;
     process.env.ZHIPUAI_AUTH_TOKEN = 'oauth-access-token';

src/daemon/models.ts

@@ -2,6 +2,7 @@ import type { Config, ModelConfig } from '../config/index.js';
 import { AnthropicClient, OpenAIClient, OllamaClient, LlamaCppClient, GeminiClient, BedrockClient, GitHubModelsClient, ModelRouter, DEFAULT_RETRY_CONFIG } from '../models/index.js';
 import type { ModelClient, RetryConfig, ModelTier } from '../models/index.js';
 import { logger } from '../logger.js';
+import { getZaiApiKey } from '../auth/zai.js';
 
 /**
  * Resolve an API key from config or environment variable.
@@ -78,6 +79,21 @@ export function createClientFromConfig(cfg: ModelConfig): ModelClient {
         baseURL: cfg.endpoint ?? 'https://openrouter.ai/api/v1',
       });
     case 'zhipuai':
+      if (cfg.use_oauth) {
+        const apiKey = getZaiApiKey();
+        if (!apiKey) {
+          throw new Error(
+            'Z.AI credential not configured. ' +
+            'Run `flynn zai-auth` or set ZAI_API_KEY / ZHIPUAI_API_KEY / ZHIPUAI_AUTH_TOKEN.',
+          );
+        }
+        return new OpenAIClient({
+          model: cfg.model,
+          apiKey,
+          baseURL: cfg.endpoint ?? 'https://api.z.ai/api/paas/v4',
+        });
+      }
+
       return new OpenAIClient({
         model: cfg.model,
         apiKey: resolveAuthCredential(cfg, 'ZHIPUAI_API_KEY', 'ZHIPUAI_AUTH_TOKEN'),