feat: add auth credential switching

[zychenzy]

Summary

Adds hermes auth switch <provider> <target> for making a pooled credential the active/default credential for any provider with entries in Hermes' credential pool.

The command reorders the selected provider's credential pool so the chosen credential becomes priority 0, preserving existing priority-based selection behavior used by the default/fill-first flow and priority tie-breaks.

For openai-codex, switching also keeps the selected pooled OAuth credential synchronized with the existing providers.openai-codex auth state, because some Codex paths still read that singleton state. This keeps Codex switching consistent across both auth-store representations.

Details

• Adds CredentialPool.activate_index()
• Adds hermes auth switch <provider> <target>
• Supports target resolution by:
  • 1-based index
  • credential id
  • exact label
• Keeps non-selected credentials in the pool and reindexes priorities
• Warns when a provider uses round_robin or random, since explicit active ordering may be overridden by that selection strategy
• Keeps Codex pool state and singleton auth state aligned without creating duplicate singleton-derived pool entries on reload

Test Plan

• python -m pytest -q tests/hermes_cli/test_auth_commands.py::test_auth_switch_reorders_provider_pool tests/hermes_cli/test_auth_commands.py::test_auth_switch_syncs_codex_singleton
• python -m pytest -q tests/hermes_cli/test_auth_commands.py
• python -m pytest -q tests/hermes_cli/test_runtime_provider_resolution.py
• git diff --check origin/main...HEAD

[teknium1]

Thanks for the credential-pool switching implementation. The capability is still absent from current main, but this version needs rework before salvage.

Problems

• agent/credential_pool.py:1097 calls _save_provider_state during Codex synchronization. That helper sets active_provider (hermes_cli/auth.py:1222-1228), so switching one Codex credential can unexpectedly change the user's global default provider.
• hermes_cli/auth_commands.py:378 warns for round_robin and random only. least_used chooses by request count before priority (agent/credential_pool.py:1496-1502), so the command can report an active credential that is not selected next.
• Current auth parsing is in hermes_cli/subcommands/auth.py:12-98, rather than the hermes_cli/main.py parser block this PR edits. The PR is also currently conflicting.

Suggested changes

• Port the command to the current parser, preserve active_provider, and update pool plus Codex singleton under one auth-store lock.
• Include least_used in the strategy warning and add documentation coverage.
• PR #45513 is a related refreshed alternative that already addresses the Codex active-provider handling and parser/docs migration.

Automated hermes-sweeper review.

[teknium1]

_save_provider_state() sets auth_store["active_provider"] to openai-codex. Switching one credential within a provider pool should not change the user's global default provider; use a state write that preserves the existing active-provider value.

[teknium1]

least_used can also select a different credential after this reorder because it chooses by request count before priority. Include it in this warning, or limit the active/default claim to fill_first.

[eonewg]

A current-main salvage is now available in #67285. It follows the sweeper recommendation to use the refreshed #45513 design, preserves the original #45513 author attribution, and includes the missing Codex synchronization, strategy warnings, current parser/docs integration, and regression coverage. #67285 explicitly supersedes both stale/conflicting implementations so review can continue in one place.