feat(trae): PKCE login, scene routing, max-mode tiers; devin quota layout; workbuddy check-in retry

[caigee-cmd]

What

Three independent changes on this branch:

feat(trae): PKCE login, scene routing, and max-mode tiers (fa2efae)

• Trae login moves to the IDE PKCE authorization-code flow (S256 code_challenge, EC P-256 device key, /trae/api/v3/oauth/ExchangeToken); pre-switch accounts keep refreshing via refresh_client_id.
• Chat requests route to the catalog scene that serves each model (chat_v3 primary, solo_work_lite fallback), fixing param errors for models solo_work_lite does not carry.
• Max mode only surfaces on models with a real second tier; ceilings resolve from *_max at render so toggling off restores defaults.
• Trae device identity switches to a 16-digit numeric device_id plus an EC device keypair for the code exchange.
• Console copy buttons fall back to a hidden textarea when the async Clipboard API is unavailable (plain-http contexts).

feat(console): stretch devin quota windows across account card (b36f48d)

• Devin daily/weekly quota meters span the account card; title, used percent, bar and reset time in one compact stack.

fix(workbuddy): retry daily check-in while upstream reports processing (519a529)

• Retry the daily check-in when upstream temporarily answers 429 "请求处理中".

Request-path impact

• Chat/completions/messages/responses gateway, translate, executor and runtime are untouched — no request-path change for any provider.
• The only workbuddy change is scoped to DailyCheckin (adds a processing-retry delay list); chat/usage/catalog are unaffected.
• interfaces.go adds optional ModelCapabilities fields (Scene is provider-internal, *_max are omitempty) — additive only.

Verification

• go build ./..., go vet ./internal/..., go test ./internal/... all green (incl. new max-tier and PKCE tests).
• Frontend tsc --noEmit clean; npm run build + npm run sync done, internal/webui/static consistent.
• Changelog fragments validated.