feat(provider): 原生接入 Windsurf provider

apps/aether-gateway/src/provider_key_auth.rs

@@ -115,7 +115,13 @@ fn key_has_auth_type_overrides(key: &StoredProviderCatalogKey) -> bool {
 fn provider_uses_bearer_oauth_runtime(provider_type: &str) -> bool {
     matches!(
         provider_type.trim().to_ascii_lowercase().as_str(),
-        "claude_code" | "codex" | "chatgpt_web" | "gemini_cli" | "antigravity" | "kiro"
+        "claude_code"
+            | "codex"
+            | "chatgpt_web"
+            | "gemini_cli"
+            | "antigravity"
+            | "kiro"
+            | "windsurf"
     )
 }
 
@@ -319,7 +325,6 @@ mod tests {
         key.encrypted_auth_config = Some(r#"{"sso_token":"abc"}"#.to_string());
 
         let semantics = provider_key_auth_semantics(&key, "grok");
-
         assert!(semantics.oauth_managed());
         assert_eq!(
             semantics.credential_kind(),
@@ -331,6 +336,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn recognizes_windsurf_oauth_as_bearer_runtime() {
+        let semantics = provider_key_auth_semantics(&sample_key("oauth"), "windsurf");
+
+        assert!(semantics.oauth_managed());
+        assert_eq!(
+            semantics.credential_kind(),
+            ProviderKeyCredentialKind::OAuthSession
+        );
+        assert_eq!(
+            semantics.runtime_auth_kind(),
+            ProviderKeyRuntimeAuthKind::Bearer
+        );
+    }
+
     #[test]
     fn refresh_capability_requires_stored_refresh_token() {
         let semantics = provider_key_auth_semantics(&sample_key("oauth"), "codex");