Support installing plugins from private GitHub repositories

What feature would you like to see?

/plugins install currently only supports public HTTPS URLs — downloads go through github.com redirects and codeload.github.com with no authentication mechanism. This makes it impossible to install plugins (or host a marketplace) from private GitHub repositories, which blocks company-internal plugin distribution.

Either of these would unblock the use case:

• SSH URLs (git@github.com:org/repo.git) using the user's existing git credentials
• HTTPS with authentication (e.g. a GITHUB_TOKEN env var, or delegating to the git credential helper)

Ideally this would work both for /plugins install <url> and for source entries in a custom marketplace JSON.

Additional information

Context: our team's plugins live in private GitHub repos. The current workaround is cloning each repo locally with git (which has credentials) and installing from local paths — workable, but it defeats the
purpose of a shared marketplace URL.

Other coding-agent harnesses support git-based plugin sources including private repos, so this gap is noticeable when adopting Kimi Code in a company setting.

Current version: kimi --version → v0.33.0

Begin with the /plugins install <url> flow and the custom marketplace JSON source entries described in the issue. Trace how public HTTPS URLs are redirected to github.com and codeload.github.com, then define completion as authenticated installation from private GitHub repositories through both supported forms.