[Astro-Han]

Summary

• Add Tencent TokenHub as a stable direct-API provider across the shared registry, Desktop, CLI, storage, headless, and runtime paths.
• Discover account models through TokenHub's protected OpenAI-compatible endpoint with an exact hy3 / hy3-preview snapshot fallback, and cover Tencent's two-stage reasoning/tool-call replay contract deterministically.
• Vendor the official Hunyuan mark byte-for-byte through the existing provider asset-mask and packaged third-party notice seams.

Why

Refs #860. Tencent TokenHub direct API access was missing from Maka's provider catalog and runtime contract. This slice adds only the direct API identity and preserves the existing single-registry ownership, discovery fallback, provider ordering, and brand-governance mechanisms introduced by preceding provider PRs.

Scope

This PR is limited to Tencent TokenHub direct API support. It does not add Tencent Coding Plan, Tencent Token Plan, any Phase 7 work, or any newly expanded provider-matrix item.

Verification

• npm run typecheck — passed for all workspaces on the final NVIDIA-based branch.
• node --test scripts/sync-model-metadata.test.mjs — 11/11 passed.
• npm --workspace @maka/core test — passed, including the Tencent registry, credential URL, ordering, exact model snapshot, and brand contracts.
• Runtime provider conformance — 11/11 passed, including Bearer authentication, protected model discovery, exact model IDs, and a deterministic two-stage tool loop that replays reasoning_content and complete tool_calls without real secrets.
• Focused headless tests — 82/82 passed; storage tests — 24/24 passed; CLI tests — 17/17 passed.
• Desktop main build and static brand governance — 16/16 passed; renderer build and packaged THIRD_PARTY_LICENSES checks passed.
• Stale generated-metadata check, upstream SVG byte comparison, and git diff --check passed; the feature worktree is clean.
• The full local npm test suite passed before the final NVIDIA rebase, including 2,414 Desktop tests. The final affected suites above were rerun after rebasing.
• Local Desktop E2E was intentionally deferred to CI as allowed for this slice; CI E2E remains a merge gate. Static provider-flow and computed mask/currentColor contracts cover the reused UI seam, so a new screenshot is not needed.
• No safe Tencent credential was available, so a real smoke test was not run. The deterministic local protocol fixture is the non-secret substitute and does not log credentials or raw provider responses.

Impact

Users can configure Tencent TokenHub with persisted provider ID tencent-tokenhub, an API key, and the default https://tokenhub.tencentmaas.com/v1 endpoint, with optional TENCENT_TOKENHUB_API_KEY, TENCENT_TOKENHUB_API_KEY_FILE, and TENCENT_TOKENHUB_BASE_URL headless configuration. Existing persisted providers need no migration. Release notes should mention Tencent TokenHub direct API support.

Reviewer notes

• Official Tencent documentation and the vendored models.dev facts were checked for the Guangzhou and international endpoints, Bearer authentication, protected GET /v1/models discovery, exact hy3 / hy3-preview IDs, and distinct OpenAI versus Anthropic compatibility paths. This implementation deliberately uses only the OpenAI protocol.
• The Hunyuan SVG is vendored byte-for-byte from @lobehub/icons-static-svg@1.91.0, immutable commit e4302041fbb3039608d25f9f618bd462783b875e, path packages/static-svg/icons/hunyuan.svg, under the MIT license. SHA-256: 7306a65eb71c4de61e21a637e5c4fef94afde823678e225c46f891cc783f6531.
• Independent review initially found two P2 issues: the signup URL did not point directly to API-key management, and the tool fixture did not lock Tencent's reasoning_content replay. Both were fixed with regression tests; the repeated review reported no P0–P3 findings and explicitly passed the first-principles/Occam's-razor standard.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable