feat: rewrite the Command Code provider on pi's native provider API

Replace the previous implementation with one that registers the Provider API
catalog through pi's own provider layer instead of shipping a custom transport,
cache file, and hand-maintained pricing table.

- models: derive the catalog from the published command-code CLI package
  (context windows, reasoning efforts, image input, output limits, rates) and
  keep it as the offline baseline; scripts/sync-catalog.mjs regenerates it and
  supports --check
- refresh: use refreshModels plus context.publish so pi persists the live
  /provider/v1/models listing in models-store.json and restores it offline
- auth: /login browser transfer through a localhost callback server with a
  pasted-key fallback; $COMMAND_CODE_API_KEY, --api-key and auth.json keep
  working
- streaming: pi's native openai-completions and anthropic-messages adapters;
  the generate-transport fallback and Oh My Pi branches are gone
- keep the context-overflow rewrite that enables pi's compaction retry and the
  /commandcode-quota command
- tests: 51 cases under tests/<module>/ covering models, catalog sync, auth,
  the callback server, overflow handling, quota, and the extension factory

Verified against the live API: chat, tool round trip, image input and
--thinking max on deepseek/deepseek-v4.1-flash, quota output, and catalog
persistence in an interactive session.

tests/overflow/overflow.test.ts

@@ -0,0 +1,69 @@
+import assert from "node:assert/strict"
+import { test } from "node:test"
+
+import {
+  normalizeCommandCodeErrorMessage,
+  normalizeCommandCodeMessage,
+  redactCommandCodeErrorText,
+} from "../../src/overflow.ts"
+
+test("provider overflow wording is rewritten to pi's generic prefix", () => {
+  const cases = [
+    "This model's maximum context length is 1000000 tokens, however you requested 1200000 tokens",
+    "prompt is too long: 210000 tokens > 200000 maximum",
+    "Input tokens exceed the context window",
+    "Request exceeds the maximum allowed input tokens",
+  ]
+
+  for (const message of cases) {
+    assert.match(normalizeCommandCodeErrorMessage(message) ?? "", /^context_length_exceeded: /, message)
+  }
+})
+
+test("retryable and quota errors are never treated as overflow", () => {
+  const cases = [
+    "rate limit exceeded, please retry",
+    "429 Too Many Requests",
+    "status: 429",
+    "Service temporarily unavailable",
+    "quota exceeded for this billing period",
+  ]
+
+  for (const message of cases) {
+    assert.equal(normalizeCommandCodeErrorMessage(message), undefined, message)
+  }
+})
+
+test("already-normalized and unrelated errors are left alone", () => {
+  assert.equal(normalizeCommandCodeErrorMessage("context_length_exceeded: prompt too long"), undefined)
+  assert.equal(normalizeCommandCodeErrorMessage("invalid api key"), undefined)
+  assert.equal(normalizeCommandCodeErrorMessage(undefined), undefined)
+})
+
+test("message rewriting only applies to Command Code assistant errors", () => {
+  const message = {
+    role: "assistant",
+    provider: "commandcode",
+    stopReason: "error",
+    errorMessage: "prompt is too long",
+  }
+
+  assert.deepEqual(normalizeCommandCodeMessage(message), {
+    message: { ...message, errorMessage: "context_length_exceeded: prompt is too long" },
+  })
+  assert.equal(normalizeCommandCodeMessage({ ...message, stopReason: "stop" }), undefined)
+  assert.equal(normalizeCommandCodeMessage({ ...message, role: "user" }), undefined)
+  assert.equal(normalizeCommandCodeMessage({ ...message, provider: "anthropic" }), undefined)
+  // pi asks the model's provider when the message provider differs.
+  assert.ok(normalizeCommandCodeMessage({ ...message, provider: "other" }, "commandcode"))
+})
+
+test("error text never leaks API keys", () => {
+  const redacted = redactCommandCodeErrorText(
+    "failed with Authorization: Bearer user_abcdefgh12345678 and apiKey=user_secret_value",
+  )
+
+  assert.ok(!redacted.includes("user_abcdefgh12345678"))
+  assert.ok(!redacted.includes("user_secret_value"))
+  assert.match(redacted, /Bearer \[redacted\]/)
+})