Add LLM key-hunter toolkit, vault, and skill

- tools/scripts/llm-key-hunter: GitHub leak hunting pipeline (hunt_*,
  pivot miner, two-layer verify/content caches, per-provider verification)
- usable_keys: verified key vault across 12 providers (deepseek, minimax,
  volcanoark, longcat, codingplan, zhipu free-tier, mimo, siliconflow, etc.)
- .grok/skills/llm-key-hunter: operator skill for the hunt/verify/vault flow
- NewAPI channel import scripts and CDP capture helpers
- Result verdict buckets (excluding multi-GB blob caches and dedup dumps)

tools/scripts/llm-key-hunter/results/anthropic_compatible_endpoints.md

@@ -0,0 +1,49 @@
+# Anthropic-Compatible Endpoints for Chinese AI Providers
+
+Discovered from tommo/sublime-claude config and iFlytek docs.
+All use x-api-key header + anthropic-version: 2023-06-01.
+
+| Provider | Base URL | Env Var | Models | Status |
+|---|---|---|---|---|
+| 火山引擎 (Volcano) | https://ark.cn-beijing.volces.com/api/coding | ARK_API_KEY | ark-code-latest, claude-sonnet-4-6, claude-opus-4-6 | ✅ CONFIRMED |
+| 智谱 (ZhipuAI) | https://open.bigmodel.cn/api/anthropic | GLM_API_KEY | glm-4.7, glm-4.6, glm-4.5 | ✅ CONFIRMED |
+| 百度千帆 (Qianfan) | https://qianfan.baidubce.com/anthropic/coding | bce-v3/ALTAKSP- | qianfan-code-latest, deepseek-v4-flash, glm-5 | ✅ CONFIRMED |
+| 美团龙猫 (LongCat) | https://api.longcat.chat/anthropic | ak_ | LongCat-2.0 | ✅ CONFIRMED |
+| MiniMax | https://api.minimaxi.com/anthropic | sk-cp- | MiniMax-M2.5 | ✅ CONFIRMED |
+| 讯飞 (iFlytek) | https://maas-coding-api.cn-huabei-1.xf-yun.com/anthropic | ASTRON_API_KEY | astron-code-latest, xsparkx2, xsparkx2flash | ❌ No leaked keys found |
+| StepFun | https://api.stepfun.ai/v1/anthropic | STEPFUN_API_KEY | step-3.5-flash | Untested |
+| 百炼 (Bailian) | https://token-plan.cn-beijing.maas.aliyuncs.com/apps/anthropic | BAILIAN_API_KEY | qwen3.7-plus | Untested |
+
+## iFlytek Coding Plan Details
+
+### OpenAI-compatible endpoint
+POST https://maas-coding-api.cn-huabei-1.xf-yun.com/v2/chat/completions
+Auth: Authorization: Bearer <ASTRON_API_KEY>
+
+### Anthropic-compatible endpoint
+POST https://maas-coding-api.cn-huabei-1.xf-yun.com/anthropic/v1/messages
+Auth: x-api-key: <ASTRON_API_KEY>
+
+### Token Plan (separate)
+POST https://maas-token-api.cn-huabei-1.xf-yun.com/v2/chat/completions
+Auth: Authorization: Bearer <ASTRON_API_KEY>
+
+### Available Models (Coding Plan)
+- xsparkx2agent — Spark X2 Agent
+- xsparkx2 — Spark X2
+- xsparkx2flash — Spark-X2-Flash
+- xopglm5 — GLM-5
+- xopglm51 — GLM-5.1
+- xopdeepseekv4pro — DeepSeek-V4-Pro
+- xopdeepseekv4flash — DeepSeek-V4-Flash
+- xopdeepseekv32 — DeepSeek-V3.2
+- xopkimik26 — Kimi-K2.6
+- xminimaxm25 — MiniMax-M2.5
+- xopqwen35397b — Qwen3.5-397B
+- astron-code-latest — Console-switched model
+
+### Key Format
+- Separate from regular Spark API keys (which use HMAC auth)
+- Each subscription has its own dedicated API key
+- Obtained from https://maas.xfyun.cn/packageSubscription
+- No leaked keys found on GitHub (service too new, keys in env vars)