Update proxy to Zhanlu v1.4.2 provider flow

The 1.4.2 extension replaced the old signed/encrypted chat gateway with an
OpenAI-compatible aigateway. Align the proxy with the new flow:

- Use ecloud.10086.cn login/model base URLs, zhanlu_ide plugin headers and
  v1.4.2 plugin version
- Provision the model API key via SM2-signed get-or-create after v1/login
  profile fetch; store api_key/model_base_url/email in credentials
- Chat via Bearer apiKey against {modelBaseUrl}/chat/completions with plain
  OpenAI SSE passthrough; fetch /v1/models from the gateway model-info endpoint
- Force HTTP/1.1 upstream (gateway drops HTTP/2 ALPN negotiation with EOF)
- Drop obsolete AES body encryption, model name mapping and vscode headers

internal/auth/sso_test.go

@@ -0,0 +1,54 @@
+package auth
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestExchangeCodeAuthTokenFlow(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/acepilot/zhanlu/authToken", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("method = %s", r.Method)
+		}
+		var in map[string]string
+		_ = json.NewDecoder(r.Body).Decode(&in)
+		if in["deputyAccountNumber"] != "dep-123" {
+			t.Errorf("deputyAccountNumber = %q", in["deputyAccountNumber"])
+		}
+		// plaintext profile (DecryptCredentialOrRaw fallback)
+		writeTestJSON(w, map[string]any{"state": "OK", "body": map[string]any{
+			"email": "[email protected]", "organization": "org", "team": "team",
+		}})
+	})
+	ts := httptest.NewServer(mux)
+	defer ts.Close()
+
+	profile, err := ExchangeCode(&http.Client{}, ts.URL+"/api/acepilot/zhanlu/authToken", "dep-123", "3jw7woww2rvhla6k")
+	if err != nil {
+		t.Fatalf("ExchangeCode: %v", err)
+	}
+	if profile.Email != "[email protected]" || profile.Organization != "org" || profile.Team != "team" {
+		t.Fatalf("profile = %+v", profile)
+	}
+}
+
+func TestExchangeCodeMissingFields(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/x", func(w http.ResponseWriter, r *http.Request) {
+		writeTestJSON(w, map[string]any{"state": "OK", "body": map[string]any{}})
+	})
+	ts := httptest.NewServer(mux)
+	defer ts.Close()
+
+	if _, err := ExchangeCode(&http.Client{}, ts.URL+"/x", "dep", ""); err == nil {
+		t.Fatal("expected error for empty profile")
+	}
+}
+
+func writeTestJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(v)
+}