feat(models): add Z.AI (GLM) credential integration and setup flow

Implement first-class Z.AI credential storage and authentication:

- New auth provider: src/auth/zai.ts for Z.AI API key management
- New CLI command: flynn zai-auth to store Z.AI API keys
- New TUI command: /login zai for interactive credential entry
- Modified src/auth/index.ts to register zai provider
- Modified src/cli/index.ts to register zai-auth command
- Modified src/cli/setup/providers.ts to include Z.AI in setup wizard
- Modified src/daemon/models.ts to support zhipuai use_oauth flag
- Modified src/daemon/clientFactory.test.ts to add Z.AI tests
- Modified src/frontends/tui/commands.ts to add login command
- Modified src/frontends/tui/minimal.ts to support credential prompts

This allows users to authenticate with Z.AI (GLM models) without
embedding secrets in config files. Credentials are stored securely in
~/.config/flynn/auth.json and resolved at runtime.

Updated state.json with new feature entry documenting the integration.

src/frontends/tui/commands.ts

@@ -124,7 +124,7 @@ Commands:
   /model [name]          Show or switch model tier (local, default, fast, complex)
   /model <tier> <p/m>    Change tier's provider/model (e.g. /model default anthropic/claude-sonnet-4)
   /backend [provider]    Show or switch local backend (ollama, llamacpp)
-  /login [provider]      Authenticate with GitHub or OpenAI
+  /login [provider]      Authenticate with GitHub, OpenAI, or Z.AI
   /pair                  List pending pairing codes and approved senders
   /pair generate [label] Generate a new DM pairing code
   /pair revoke <ch> <id> Revoke an approved sender
@@ -178,7 +178,7 @@ export const COMMAND_TOOLTIPS: Record<string, string> = {
   '/status': 'Show session info and token usage',
   '/fullscreen': 'Switch to fullscreen mode',
   '/fs': 'Switch to fullscreen mode',
-  '/login': 'Authenticate with GitHub or OpenAI (OAuth device flow)',
+  '/login': 'Authenticate with GitHub/OpenAI (OAuth) or Z.AI (API key store)',
   '/pair': 'Generate/list/revoke DM pairing codes',
   '/transfer': 'Transfer session to another frontend',
   '/quit': 'Exit TUI',

src/frontends/tui/minimal.ts

@@ -9,7 +9,7 @@ import type { ModelConfig, ModelProvider } from '../../config/schema.js';
 import { MODEL_PROVIDERS } from '../../config/schema.js';
 import { OllamaClient, LlamaCppClient } from '../../models/index.js';
 import { createClientFromConfig } from '../../daemon/index.js';
-import { loginGitHub, loginOpenAI } from '../../auth/index.js';
+import { loginGitHub, loginOpenAI, loadStoredZaiAuth, storeZaiAuth } from '../../auth/index.js';
 import type { PairingManager } from '../../channels/pairing.js';
 import { getColoredBanner } from './banner.js';
 import type { HookEngine } from '../../hooks/index.js';
@@ -465,7 +465,63 @@ export class MinimalTui {
       return;
     }
 
-    console.log(`${colors.gray}Unknown login provider:${colors.reset} ${target}. Supported: github, openai\n`);
+    if (target === 'zai' || target === 'zhipuai') {
+      const existing = loadStoredZaiAuth();
+      if (existing) {
+        console.log(`${colors.gray}Z.AI credential already exists.${colors.reset}`);
+        console.log(`${colors.gray}Delete ~/.config/flynn/auth.json zai/zhipuai entry to re-authenticate.${colors.reset}\n`);
+        return;
+      }
+
+      console.log(`${colors.gray}Z.AI uses API keys (HTTP Bearer), not an OAuth device flow.${colors.reset}`);
+      console.log(`${colors.gray}Create a key at:${colors.reset} https://z.ai/manage-apikey/apikey-list`);
+      console.log('');
+
+      if (!this.rl) {
+        console.log(`${colors.gray}TUI not ready for login prompt. Run: flynn zai-auth${colors.reset}\n`);
+        return;
+      }
+
+      const promptHidden = async (question: string): Promise<string> => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+        const rlAny = rl as any;
+        rlAny.stdoutMuted = true;
+        rlAny._writeToOutput = (s: string) => {
+          if (!rlAny.stdoutMuted) {
+            process.stdout.write(s);
+            return;
+          }
+          if (s.includes('\n')) {
+            process.stdout.write('\n');
+          } else {
+            process.stdout.write('*');
+          }
+        };
+        const answer = await new Promise<string>((resolve) => rl.question(question, resolve));
+        rlAny.stdoutMuted = false;
+        rl.close();
+        process.stdout.write('\n');
+        return answer.trim();
+      };
+
+      try {
+        this.rl.pause();
+        const apiKey = await promptHidden('Enter Z.AI API key: ');
+        storeZaiAuth(apiKey);
+        console.log('');
+        console.log(`${colors.gray}Z.AI credential stored in ~/.config/flynn/auth.json${colors.reset}`);
+        console.log(`${colors.gray}Tip: For GLM Coding Plan set endpoint to https://api.z.ai/api/coding/paas/v4${colors.reset}\n`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.log(`${colors.gray}Z.AI auth failed:${colors.reset} ${message}\n`);
+      } finally {
+        this.rl.resume();
+      }
+
+      return;
+    }
+
+    console.log(`${colors.gray}Unknown login provider:${colors.reset} ${target}. Supported: github, openai, zai\n`);
   }
 
   private handlePairCommand(action?: 'generate' | 'list' | 'revoke', args?: string): void {