fix(web-server): make kiro auth routes method-aware

- validate kiroMethod on /start and /start-url with clear errors

- route Kiro management start-url requests with upstream method query

- accept state-first responses and keep auth_url optional

- add start-url guard tests for Kiro social and aws-authcode paths

Refs #552

Refs #233

tests/unit/web-server/cliproxy-auth-routes.test.ts

@@ -3,11 +3,22 @@ import { getStartUrlUnsupportedReason } from '../../../src/web-server/routes/cli
 
 describe('cliproxy-auth-routes start-url guard', () => {
   it('rejects device code providers', () => {
-    expect(getStartUrlUnsupportedReason('kiro')).toContain("Provider 'kiro' uses Device Code flow");
+    expect(getStartUrlUnsupportedReason('kiro')).toContain("Kiro method 'aws' uses Device Code flow");
     expect(getStartUrlUnsupportedReason('ghcp')).toContain("Provider 'ghcp' uses Device Code flow");
     expect(getStartUrlUnsupportedReason('qwen')).toContain("Provider 'qwen' uses Device Code flow");
   });
 
+  it('allows Kiro social methods on start-url', () => {
+    expect(getStartUrlUnsupportedReason('kiro', { kiroMethod: 'google' })).toBeNull();
+    expect(getStartUrlUnsupportedReason('kiro', { kiroMethod: 'github' })).toBeNull();
+  });
+
+  it('rejects Kiro aws-authcode method on start-url', () => {
+    expect(getStartUrlUnsupportedReason('kiro', { kiroMethod: 'aws-authcode' })).toContain(
+      "Kiro method 'aws-authcode' uses CLI auth flow"
+    );
+  });
+
   it('allows authorization code providers', () => {
     expect(getStartUrlUnsupportedReason('gemini')).toBeNull();
     expect(getStartUrlUnsupportedReason('codex')).toBeNull();