feat: add Codex browser OAuth fallback

[mikkelchokolate]

Summary

• Adds a browser-based PKCE OAuth fallback for OpenAI Codex authentication
• Preserves credential metadata across auth store and credential pool refresh paths
• Updates Codex auth/model tests and provider docs for the new flow

Test Plan

• venv/bin/python -m py_compile agent/credential_pool.py hermes_cli/auth.py hermes_cli/main.py
• venv/bin/python -m pytest tests/hermes_cli/test_auth_codex_provider.py tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_codex_models.py -o 'addopts=' -q

[teknium1]

Thanks for adding a concrete PKCE fallback for Codex accounts where device code is unavailable. Current main still routes fresh Codex logins directly to device code (hermes_cli/auth.py:6930-6939), so the feature remains relevant.

Problems

• agent/credential_pool.py:619 and :644 call _save_provider_state during pool refresh. That helper always updates active_provider (hermes_cli/auth.py:1222-1228), so a token refresh can silently switch the user's selected provider. Keep the non-activating write path.
• The branch predates current Codex refresh serialization. Main holds _auth_store_lock across sync, refresh POST, and write-back (agent/credential_pool.py:968-990), added by da6d5fcd to prevent reuse of single-use refresh tokens. Preserve that behavior when salvaging the Codex changes.
• hermes_cli/auth.py:2219, :2225, and :2227 add behavioral HERMES_* overrides. AGENTS.md:102-107 requires behavioral settings to use config.yaml.

Suggested changes

• Carry the browser-PKCE implementation onto current auth/pool code without replacing current refresh and provider-selection safeguards.
• Add focused tests for the resulting current-main browser login and refresh path.

Automated hermes-sweeper review.

[teknium1]

_save_provider_state sets auth_store["active_provider"] unconditionally (hermes_cli/auth.py:1222-1228). A pool refresh is token rotation, not an explicit provider selection; retain _store_provider_state(..., set_active=False) here so it cannot switch the user's active provider.

[teknium1]

Please do not add a new non-secret HERMES_* configuration surface for OAuth scope. Per AGENTS.md:102-107, behavioral settings belong in config.yaml; remove this override unless a supported config.yaml setting is added through the normal configuration flow.