fix(ai): keep provider curl secrets off argv

Pass AI provider Authorization headers and refresh tokens through curl --config - stdin instead of process arguments, and cover Antigravity CSRF argv regression with tests.

Co-authored-by: wangchenguang <darion.yaphets@gmail.com>

Release V0.12.2

Release V0.12.1

Release V0.12.0

Release V0.11.0

Release V0.10.0

Release V0.9.0

Release V0.8.0

Kaku v0.4.0

V0.7.1 - fix startup hang