feat(Wlain/kling-ai): add Kling AI remote MCP plugin

[Wlain]

What

Adds the Kling AI China Agent Plugin under plugins/Wlain/kling-ai with:

• one streamable-http MCP server at https://klingai.com/mcp;
• three Skills for account/task routing, image generation, and video generation;
• explicit single-submit billing safety, task-ID handoff, and result fallback rules;
• network, data-use, credential, and paid-service disclosures.

Why

This gives MiniMax Code users a Skill-guided path to Kling image, video, motion-control, account-credit, upload, Element, and task-query tools without embedding API keys, tokens, cookies, or a local MCP server.

Requirements and data flow

• Requires a Kling China account; real generation may consume account credits.
• User prompts, explicitly supplied reference media, and generation parameters are sent to https://klingai.com/mcp.
• OAuth credentials must remain host-managed and must not enter Plugin files, chat, or logs.
• X-Kling-Integration: Plugin-MiniMaxCode is a non-secret integration marker, not an authorization header.

Validation

• npm ci
• npm run check
• Repository validation: 19 hosted Plugins and all examples passed.
• Test suite: 110 passed, 0 failed.
• MiniMax Code 3.0.67 local package discovery: 1 MCP server and 3 Skills discovered.

Runtime compatibility gate

This PR is intentionally a Draft. MiniMax Code 3.0.67 currently does not start browser OAuth after the protected remote MCP returns the standard 401 challenge, so tools/list and live tool injection cannot complete. Generic OAuth is also documented as outside the current public portable subset.

The host-side blocker is tracked in MiniMax-AI/minimax-code#120. Please do not treat the live MCP workflow as generally available until a MiniMax Code build completes protected-resource discovery, DCR or a host-managed pre-registered client, Authorization Code + S256 PKCE, token refresh, and post-login tools/list injection. The package does not work around this with a local proxy or pasted credentials.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Wlain]

Hi maintainers — could you please review this submission and advise whether it can be accepted into the marketplace while protected remote MCP OAuth support is tracked in MiniMax-AI/minimax-code#120? The package is mergeable, repository validation passes (110 tests), and MiniMax Code 3.0.67 locally discovers the single remote MCP server and all three Skills. It intentionally does not add a local proxy or pasted-credential workaround. If marketplace publication must wait for host-side OAuth support, I am happy to keep it pending and make any packaging or metadata changes you recommend. Thank you!

[hetaoBackend]

Current head 487d44f is statically valid and the endpoint advertises OAuth discovery (an unauthenticated MCP initialize correctly receives 401 plus the protected-resource metadata challenge). However, the PR README itself says MiniMax Code 3.0.67 cannot start the required OAuth flow or inject tools, calls this contribution Draft-only until host support and real tools/list/authorization are available, while the GitHub PR is not marked Draft. Please mark the PR Draft and/or provide an actual supported-host OAuth/tools-list integration result before presenting this as an installable plugin. [code]smith is SKIPPED.