fix(auth): recover OAuth flows after transient failures

[wbxl2000]

Related Issue

• N/A

Summary

• route connection recovery retries back through the full auth recovery path so a post-timeout 401 can force-refresh OAuth instead of immediately surfacing /login
• refresh managed-platform models through OAuthManager and retry once on 401 so startup model sync can recover stale access tokens
• add regression coverage for both retry paths

Testing

• uv run pytest tests/core/test_auth_error_handling.py tests/core/test_kimisoul_retry_recovery.py tests/auth/test_platforms.py
• uv run ruff check src/kimi_cli/soul/kimisoul.py src/kimi_cli/auth/platforms.py tests/core/test_kimisoul_retry_recovery.py tests/auth/test_platforms.py

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

[wbxl2000]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".