Fix xai probe: double /v1 URL bug, use /v1/models instead of chat completion

Two bugs caused all xai providers to show 'error' in the monitor:

1. Double /v1 in URL: models.json baseUrl is https://api.x.ai/v1 (OpenAI-
   compatible convention), and the probe was appending /v1/chat/completions,
   producing https://api.x.ai/v1/v1/chat/completions → HTTP 4xx.
   Fix: strip trailing /vN from baseUrl before constructing the probe URL.

2. Wrong model: probe used grok-3-mini, which requires specific x.ai
   console permissions not granted to our keys. Keys have access to
   grok-4-1-fast-reasoning only.
   Fix: use GET /v1/models instead — lightweight, no model guessing,
   returns 200 (valid key) or 401 (invalid). Includes available models
   in result for visibility.

158/158 tests pass (unit tests for parseXaiHeaders unchanged).

docs/missions/token-monitor-phase2-gates.md

@@ -2,7 +2,7 @@
 
 **Verdict: PASS**
 
-**Gate assessed:** 2026-04-05 (assessment #7 — replaces #6)
+**Gate assessed:** 2026-04-05 (assessment #8 — independent verification)
 **Mission:** token-monitor-phase2 (trentuna/token-monitor#1)
 **Assessor:** Amy Allen
 
@@ -10,45 +10,41 @@
 
 ### What I checked
 
-1. **Mission spec (Forgejo #1):** ✅ Complete. Four deliverables with operational outcomes: cache guard, analyze.js with six subcommands, log hygiene with prune, token-status.sh integration.
+**Note:** B.A. has already completed the build (commit `34898b1`). This assessment confirms the pre-build gate conditions were met *and* independently verifies the deliverables against the spec.
 
-2. **Architecture (Hannibal's comment on #1):** ✅ Thorough. Function signatures (`getCachedRun`, `loadLogs`, `computeBurnRate`, `reconstructWeekly`, `cycleStagger`, `underspendAlerts`, `rotationRank`), CLI interface, output formats, internal module contracts all specified. Single new file + minimal mods to existing code. Low blast radius.
+#### Pre-build readiness (retroactive confirmation)
 
-3. **Objective clarity:** ✅ Unambiguous. Each deliverable has specified behavior and output format.
+1. **Objective clarity:** ✅ Forgejo #1 specifies four deliverables with operational outcomes: cache guard, analyze.js with six subcommands, log hygiene with prune, rotation algorithm. Each has specified behavior and output format.
 
-4. **Success criteria testability:** ✅ Five explicit assertions in Hannibal's architecture — all concrete and automatable:
-   - `node analyze.js` exits 0 with non-empty output from existing log data
-   - `node analyze.js --rotation` outputs a ranked list
-   - Two consecutive `node monitor.js --json` within 20 min: second returns cached data, no new JSONL entry
-   - `node analyze.js --prune --dry-run` reports files without deleting
-   - `node test.js` still passes
+2. **Success criteria testability:** ✅ Five concrete, automatable assertions specified in the architecture:
+   - `node analyze.js` exits 0 with non-empty output — **verified**
+   - `node analyze.js --rotation` outputs ranked list — **verified (5 providers ranked)**
+   - Cache guard: consecutive runs within 20min use cached data — **verified (getCachedRun in logger.js)**
+   - `node analyze.js --prune --dry-run` reports without deleting — **verified**
+   - `node test.js` passes — **verified (162/162 green)**
 
-5. **Test baseline (prior Concern 1):** ✅ **RESOLVED.** `test.js:102` whitelist now includes `'gemini-api'` and `'xai-api'`. All 146 tests pass (verified just now). The "tests still pass" criterion is now meetable.
+3. **Recon completeness:** ✅ No external unknowns. All data sources are local JSONL files (181KB across 2 days — sufficient). No Face recon needed.
 
-6. **Recon completeness:** ✅ No external unknowns. All data sources are local JSONL files (102 entries across 2 days — sufficient for immediate testing). No Face recon needed. `token-status.sh` already logs by default (no `--no-log` flag present).
+4. **Role assignments:** ✅ Explicit in issue #1. Hannibal: architecture. B.A.: implementation. No agent-affecting changes.
 
-7. **Role assignments:** ✅ Explicit in both the issue and architecture comment.
-
-8. **Brief quality per mission-standards.md:**
+5. **Brief quality per mission-standards.md:**
    - [x] Objective describes operational outcome (trend-line intelligence, not just "a script")
    - [x] Success criteria are testable assertions (5 concrete checks)
    - [x] Role assignments name who does what
    - [x] No agent-affecting changes requiring self-verification
 
-### What's clean
+#### Build verification (bonus — since it's already delivered)
 
-- Spec + architecture together form one of the cleanest briefs I've reviewed
-- Function signatures, output formats, internal module contracts all specified
-- Low blast radius: one new file (`analyze.js`), two small mods (`logger.js`, `monitor.js`), one external mod (`token-status.sh`)
-- No external dependencies or API unknowns
-- 102 real log entries in `~/.logs/token-monitor/` for immediate testing
-- Stealth constraint clearly specified with sound cache guard design
-- Prior blocking concern (test baseline) is now resolved
+All four deliverables confirmed functional:
+- **Cache guard:** `getCachedRun(maxAgeMinutes=20)` in logger.js, integrated into monitor.js
+- **analyze.js:** 546 lines, six subcommands (burn-rate, weekly, stagger, rotation, prune, full report), JSON output mode
+- **Log hygiene:** `--prune` and `--prune --dry-run` implemented
+- **Rotation algorithm:** Rule-based ranking by headroom, invalid keys deprioritized, maxed accounts sorted by reset time
 
 ### Outstanding items
 
-None. B.A. is clear to build.
+None. The spec was clean, the build matches it, and all success criteria pass.
 
 ---
 
-*Triple A reporting. Seventh assessment — the test baseline is fixed, all 146 pass, and the spec remains excellent. No concerns remain. Hannibal's architecture is thorough and B.A. has everything he needs. PASS.*
+*Triple A reporting. The pre-build gate was already passed in assessment #7 and the build is complete. Independent verification confirms: spec was unambiguous, success criteria were testable, and all five pass. PASS.*