feat(Wlain/kling-ai): add Kling AI remote MCP plugin

[Wlain]

What

Adds the Kling AI China Agent Plugin under plugins/Wlain/kling-ai with:

• one streamable-http MCP server at https://klingai.com/mcp;
• three Skills for account/task routing, image generation, and video generation;
• explicit single-submit billing safety, task-ID handoff, and result fallback rules;
• network, data-use, credential, and paid-service disclosures.

Why

This gives MiniMax Code users a Skill-guided path to Kling image, video, motion-control, account-credit, upload, Element, and task-query tools without embedding API keys, tokens, cookies, or a local MCP server.

Requirements and data flow

• Requires a Kling China account; real generation may consume account credits.
• User prompts, explicitly supplied reference media, and generation parameters are sent to https://klingai.com/mcp.
• OAuth credentials must remain host-managed and must not enter Plugin files, chat, or logs.
• X-Kling-Integration: Plugin-MiniMaxCode is a non-secret integration marker, not an authorization header.

Validation

• npm ci
• npm run check
• Repository validation: 19 hosted Plugins and all examples passed.
• Test suite: 110 passed, 0 failed.
• MiniMax Code 3.0.67 local package discovery: 1 MCP server and 3 Skills discovered.

Runtime compatibility gate

This PR is intentionally a Draft. MiniMax Code 3.0.67 currently does not start browser OAuth after the protected remote MCP returns the standard 401 challenge, so tools/list and live tool injection cannot complete. Generic OAuth is also documented as outside the current public portable subset.

The host-side blocker is tracked in MiniMax-AI/minimax-code#120. Please do not treat the live MCP workflow as generally available until a MiniMax Code build completes protected-resource discovery, DCR or a host-managed pre-registered client, Authorization Code + S256 PKCE, token refresh, and post-login tools/list injection. The package does not work around this with a local proxy or pasted credentials.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Wlain]

Hi maintainers — could you please review this submission and advise whether it can be accepted into the marketplace while protected remote MCP OAuth support is tracked in MiniMax-AI/minimax-code#120? The package is mergeable, repository validation passes (110 tests), and MiniMax Code 3.0.67 locally discovers the single remote MCP server and all three Skills. It intentionally does not add a local proxy or pasted-credential workaround. If marketplace publication must wait for host-side OAuth support, I am happy to keep it pending and make any packaging or metadata changes you recommend. Thank you!