Prefer SSO OAuth PKCE for CPA minting and sync latest accounts.

Switch CPA export to SSO→Authorization Code with referrer=grok-build, keep device-code as optional fallback, and capture new register/auth artifacts.

cpa/__init__.py

@@ -6,6 +6,9 @@ from .schema import (
     CLI_BASE_URL,
     CLIENT_ID,
     DEFAULT_BASE_URL,
+    DEFAULT_HEADERS,
+    GROK_TOKEN_UA,
+    GROK_VERSION,
     REDIRECT_URI,
     TOKEN_ENDPOINT,
     build_cpa_xai_auth,
@@ -19,6 +22,9 @@ __all__ = [
     "CLI_BASE_URL",
     "CLIENT_ID",
     "DEFAULT_BASE_URL",
+    "DEFAULT_HEADERS",
+    "GROK_TOKEN_UA",
+    "GROK_VERSION",
     "REDIRECT_URI",
     "TOKEN_ENDPOINT",
     "CpaPushError",