feat: add cpa-auth-inspect plugin

[nosovk]

This PR adds the cpa-auth-inspect plugin to the store registry.
It provides:

• Multi-provider authentication inspector (xAI, Codex, Claude, Gemini)
• Local checking of JSON files, token expiration dates, and disabled status
• Automatic re-auth via DrissionPage / Chromium
• Embedded audit UI registered in Management Center

[gemini-code-assist]

Code Review

This pull request registers a new plugin, 'CPA Auth Inspect' (cpa-auth-inspect), to the registry.json file. The plugin is a multi-provider authentication inspector and management-menu plugin for CLIProxyAPI. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[nosovk]

duplicate of #28

[luispater]

Security audit: high-risk behavior found

This submission is being closed following the plugin security audit.

The store entry declares version 0.2.0 but does not pin a tag, release asset, or checksum. The referenced repository default branch is eight commits ahead of v0.2.0 and adds automated xAI/Codex reauthorization behavior. That code:

• reads passwords, refresh tokens, session tokens, and SSO cookies from mounted credential files;
• launches Chromium to enter credentials and grant device authorization;
• bundles a turnstilePatch extension that masks navigator.webdriver and attempts to click Turnstile challenges automatically; and
• accepts base_url and token_endpoint from xAI credential JSON without an allowlist, then sends bearer or refresh tokens to those endpoints during live probes or refreshes.

These are high-risk credential-handling and anti-bot-evasion behaviors. Please remove them, publish an immutable reviewed release with a pinned asset checksum, and resubmit for review.