#12063: feat: add Moonshot (Kimi K2.5) native video understanding provider

## Summary Add Moonshot AI (Kimi K2.5) as a native video understanding provider for media-understanding. K2.5 uses **MoonViT** — a native multimodal vision encoder trained on video tokens, providing true video understanding rather than frame extraction. ## Changes - **New provider**: `src/media-understanding/providers/moonshot/` (index + video) - **Registration**: Added to provider registry in `providers/index.ts` - **Auto-detection**: Added `moonshot` to `AUTO_VIDEO_KEY_PROVIDERS` in `runner.ts` ## How it works - Uses OpenAI-compatible API at `https://api.moonshot.ai/v1` - Sends video as base64 data URI via `video_url` content type - Handles K2.5's thinking mode (`reasoning_content` fallback) - Auto-detects via `MOONSHOT_API_KEY` environment variable - Model: `kimi-k2.5` (1T params, 32B activated, 256K context) ## Testing - Verified with demo video (264KB mp4 → 20K tokens) - K2.5 correctly identified video content using native vision - API authentication and response parsing working correctly <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR wires in a new `moonshot` media-understanding provider with image+video capabilities. It registers the provider in the media provider registry, adds a Moonshot video implementation that calls an OpenAI-compatible `/chat/completions` endpoint with `video_url` as a base64 data URI, and extends auto-detection so video can be resolved via `MOONSHOT_API_KEY`. Key integration points are `src/media-understanding/providers/index.ts` (registry) and `src/media-understanding/runner.ts` (auto video provider list + provider invocation). <h3>Confidence Score: 3/5</h3> - This PR is close to mergeable but has a couple of behavioral/security issues that should be fixed first. - Score reduced due to (1) video provider config (baseUrl/headers) being ignored, which will break intended configuration like Moonshot CN endpoint, and (2) SSRF policy being widened to allow private-network access based solely on providing a custom baseUrl. - src/media-understanding/runner.ts; src/media-understanding/providers/moonshot/video.ts <!-- greptile_other_comments_section --> <!-- /greptile_comment -->