Fix Alibaba Personal/Solo workspace authorization

[Finesssee]

Fixes #350 by porting the applicable behavior from upstream CodexBar steipete#2533 into the Windows Rust provider.

Ported

• remove the captured hardcoded Personal/Solo switchAgent workspace selector
• resolve and forward best-effort sec_token on Personal/Solo requests
• inspect the exact nested success:false gateway frame and surface errorCode / errorMsg instead of generic request failed
• preserve Workspace.NotAuthorised as a provider permission error rather than converting it to AuthRequired
• add direct regression coverage for omitted switchAgent, optional sec_token, nested workspace authorization errors, and nested gateway messages

Skipped

• upstream Swift-specific fetch-strategy/cache-injection refactors do not apply to the Rust provider architecture
• no macOS Keychain behavior is ported

Deferred

• live CN/Singapore account verification requires a reporter account/session; deterministic request/error regressions cover the observed gateway contract locally

Verification

• cargo test -p codexbar alibabatokenplan: 13/13 PASS
• cargo clippy -p codexbar --all-targets -- -D warnings: PASS
• full cargo test -p codexbar --all-targets: 1291/1292 PASS; only the known CodexPro environment failure cli::tty_runner::tests::test_run_sends_script_through_pty -> BinaryNotFound(cmd)
• git diff --check: PASS
• local rustfmt check unavailable because the Rustfmt component is not installed; hosted PR CI remains authoritative for fmt

[Finesssee]

Thermo-nuclear review: FIX requested before approval. Behavior is correct and focused, no file crosses the 1k threshold because mod.rs was already >1k on main, and the shared nested-error parser is in the canonical Alibaba layer. One structural issue remains: sec_token is threaded through multiple already parameter-heavy Personal helper signatures. Upstream steipete#2533 intentionally collapsed the same request state into a Personal API context. I am refactoring that internal orchestration now so the change does not add argument plumbing/spaghetti while keeping the pure form builder directly testable. No other blocker found.

[Finesssee]

Thermo-nuclear follow-up: PASS. The one structural finding is resolved by PersonalApiContext, which removes repeated request-state argument plumbing while preserving the pure form builder for direct regression coverage. Final checks on head 9f91619: hosted Rust format PASS, workspace Clippy PASS, full workspace Rust tests PASS, frontend tests PASS, frontend typecheck/build PASS, interaction guards PASS. Local focused Alibaba suite remains 13/13 PASS. No remaining thermo blocker found.