feat(auth): add OAuth2 support for xAI with PKCE and token persistence

- Implemented xAI OAuth2 integration with PKCE (Proof Key for Code Exchange) support.
- Added logic for token exchange, refresh, and persistent storage in JSON format.
- Created `xai` package with helpers for OAuth discovery, API token handling, and URL building.
- Introduced `XAIExecutor` for integrating xAI credentials into runtime HTTP requests.
- Added unit tests to validate OAuth flow, token persistence, and endpoint validation.

internal/auth/xai/pkce.go

@@ -0,0 +1,20 @@
+package xai
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+)
+
+// GeneratePKCECodes creates a verifier/challenge pair for the OAuth flow.
+func GeneratePKCECodes() (*PKCECodes, error) {
+	bytes := make([]byte, 96)
+	if _, err := rand.Read(bytes); err != nil {
+		return nil, fmt.Errorf("xai pkce: generate verifier: %w", err)
+	}
+	verifier := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(bytes)
+	hash := sha256.Sum256([]byte(verifier))
+	challenge := base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash[:])
+	return &PKCECodes{CodeVerifier: verifier, CodeChallenge: challenge}, nil
+}