fix(cliproxy): mark Kiro as device_code flow for dashboard auth

CLIProxyAPIPlus uses device code flow for Kiro authentication, returning
{method: "device_code", state, status} without an immediate URL. The URL
is provided via polling the /get-auth-status endpoint.

Previously, Kiro was configured as authorization_code flow, causing
dashboard auth to fail with "No authorization URL received from CLIProxyAPI"
because the web-server routes expected synchronous URL response.

Changes:
- provider-capabilities.ts: kiro.oauthFlow = 'device_code', callbackPort = null
- provider-config.ts: Add 'kiro' to DEVICE_CODE_PROVIDERS array
- provider-capabilities.test.ts: Update test expectations

This routes Kiro through /start endpoint which properly handles device code
flow via WebSocket events (deviceCodeReceived, deviceCodeCompleted, etc).

Closes #552

src/cliproxy/provider-capabilities.ts

@@ -46,8 +46,8 @@ export const PROVIDER_CAPABILITIES: Record<CLIProxyProvider, ProviderCapabilitie
   },
   kiro: {
     displayName: 'Kiro (AWS)',
-    oauthFlow: 'authorization_code',
-    callbackPort: 9876,
+    oauthFlow: 'device_code',
+    callbackPort: null,
     aliases: ['codewhisperer'],
   },
   ghcp: {