fix(cliproxy): harden provider alias and refresh edge cases

- guard provider alias generation against ambiguous collisions

- add account-scoped Gemini token refresh with strict account checks

- warn and fallback on invalid management remote ports

- align remaining HTTP remote defaults and extend cliproxy tests

tests/unit/cliproxy/management-api-client.test.ts

@@ -1,7 +1,7 @@
 /**
  * Unit tests for management-api-client module
  */
-import { describe, it, expect, beforeEach, mock } from 'bun:test';
+import { describe, it, expect, beforeEach, mock, spyOn } from 'bun:test';
 import { ManagementApiClient } from '../../../src/cliproxy/management-api-client';
 import type {
   ManagementClientConfig,
@@ -76,6 +76,18 @@ describe('management-api-client', () => {
         const client = new ManagementApiClient(configNoPort);
         expect(client.getBaseUrl()).toBe('https://localhost');
       });
+
+      it('should warn and fall back when configured port is invalid', () => {
+        const warnSpy = spyOn(console, 'warn').mockImplementation(() => {});
+
+        const client = new ManagementApiClient({ ...config, port: 99999 });
+        expect(client.getBaseUrl()).toBe('http://localhost:8317');
+        expect(warnSpy).toHaveBeenCalledWith(
+          '[management-api-client] Invalid port "99999", using default 8317'
+        );
+
+        warnSpy.mockRestore();
+      });
     });
 
     describe('error code mapping', () => {

tests/unit/cliproxy/provider-capabilities.test.ts

@@ -1,8 +1,10 @@
 import { describe, expect, it } from 'bun:test';
 import {
+  buildProviderAliasMap,
   CLIPROXY_PROVIDER_IDS,
   getOAuthCallbackPort,
   getOAuthFlowType,
+  PROVIDER_CAPABILITIES,
   getProviderDisplayName,
   getProvidersByOAuthFlow,
   isCLIProxyProvider,
@@ -68,7 +70,25 @@ describe('provider-capabilities', () => {
     expect(getOAuthCallbackPort('qwen')).toBeNull();
     expect(getOAuthCallbackPort('kiro')).toBeNull();
     expect(getOAuthCallbackPort('gemini')).toBe(8085);
-    expect(getProviderDisplayName('agy')).toBe('AntiGravity');
+    expect(getProviderDisplayName('agy')).toBe('Antigravity');
+  });
+
+  it('throws when provider aliases collide across providers', () => {
+    const capabilitiesWithCollision = {
+      ...PROVIDER_CAPABILITIES,
+      gemini: {
+        ...PROVIDER_CAPABILITIES.gemini,
+        aliases: ['shared-alias'],
+      },
+      codex: {
+        ...PROVIDER_CAPABILITIES.codex,
+        aliases: ['shared-alias'],
+      },
+    };
+
+    expect(() =>
+      buildProviderAliasMap(capabilitiesWithCollision as typeof PROVIDER_CAPABILITIES)
+    ).toThrow(/shared-alias/i);
   });
 
   it('keeps diagnostics flow metadata in sync with provider capabilities', () => {