fix: respect SSL_CERT_FILE env var for corporate proxy support

[aaraujodata]

Summary

Adds support for the standard SSL_CERT_FILE environment variable, enabling users behind corporate proxies (e.g., Zscaler, BlueCoat, Fortinet) to use Kimi CLI without SSL certificate verification errors.

Fixes #760

Problem

Users behind corporate proxies experience SSL certificate verification failures when running /login:

Login failed: Cannot connect to host auth.kimi.com:443 ssl:True 
[SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] 
certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')]

This occurs because src/kimi_cli/utils/aiohttp.py hardcodes certifi.where() and ignores the standard SSL_CERT_FILE environment variable that corporate users set to include their proxy's CA certificate.

Solution

• Check SSL_CERT_FILE environment variable before falling back to certifi
• Maintain full backward compatibility (no change for users without the env var)
• Follow the same pattern used by other Python tools (requests, httpx, pip)

Changes

File	Change
src/kimi_cli/utils/aiohttp.py	Added _get_ssl_ca_file() function that respects SSL_CERT_FILE

Security Considerations

• ✅ Only reads from a well-known, standard environment variable (SSL_CERT_FILE)
• ✅ No new attack surface introduced
• ✅ Follows Python's SSL best practices (ssl.SSLContext.load_verify_locations)
• ✅ No user data exposure
• ✅ Environment variable is read-only, not written

Test Plan

• Verified make format-kimi-cli passes
• Verified make check-kimi-cli passes (ruff + pyright)
• Manual test: Set SSL_CERT_FILE to custom CA bundle and verify /login works
• Manual test: Unset SSL_CERT_FILE and verify default behavior (certifi) still works

Documentation

The SSL_CERT_FILE environment variable is a widely recognized standard:

• Python ssl module documentation
• OpenSSL documentation
• Used by: requests, httpx, pip, curl, and many other tools

---

🤖 Generated with Claude Code

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional flags.