fix(auth): rewrite stale MiniMax OAuth verification_uri host

[Tranquil-Flow]

What does this PR do?

MiniMax's OAuth /oauth/code endpoint returns a verification_uri of the form https://www.minimax.io/oauth-authorize?user_code=...&client=OpenClaw, but that path was retired and now 307-redirects to the marketing homepage /, leaving users with no way to approve the device code. The live approval UI is at https://platform.minimax.io/oauth-authorize?....

This PR adds a defensive client-side rewrite in _minimax_oauth_login: when verification_uri host is exactly www.minimax.io and the path starts with /oauth-authorize, the host is rewritten to platform.minimax.io before the URL is printed or opened. Any other host or path passes through unchanged, so the rewrite auto-disables once MiniMax fixes the server response, and the CN portal (api.minimaxi.com) is unaffected (different brand domain entirely).

This is option (1) from the issue. The reporter flagged option (2) — escalating to MiniMax to fix the server-side verification_uri — as the cleaner long-term path, but unblocking users today is worth the small workaround.

Related Issue

Fixes #19337

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/auth.py — add _minimax_normalize_verification_uri(url) helper just above _minimax_pkce_pair; apply it at the call site in _minimax_oauth_login where verification_uri is read from code_data. A short comment block in the source records the workaround and its removal condition. parts.hostname and parts.port are accessed inside the try because both properties re-parse the netloc and can raise ValueError on malformed input (e.g. an out-of-range port).
• tests/test_minimax_oauth.py — add three unit tests covering: (a) the real-world stale URL gets rewritten with the query string preserved, (b) unrelated URLs (already-platform host, apex minimax.io, CN minimaxi.com, non-authorize paths) pass through unchanged, (c) malformed/empty/bad-port inputs are returned untouched.

How to Test

1. Run `pytest tests/test_minimax_oauth.py -q` → 18 tests pass (3 new).
2. End-to-end (requires a MiniMax Plus account):
   • `hermes model` → choose "MiniMax via OAuth browser login".
   • Hermes prints `Open: https://platform.minimax.io/oauth-authorize?user_code=...&client=OpenClaw\` (note the rewritten host).
   • The browser loads the live approval UI; approving completes the device-code flow.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (`fix(scope):`, `feat(scope):`, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run `pytest tests/test_minimax_oauth.py -q` and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.6 (arm64)

Documentation & Housekeeping

• I've updated relevant documentation (README, `docs/`, docstrings) — N/A (workaround is internal; the in-source comment documents it)
• I've updated `cli-config.yaml.example` if I added/changed config keys — N/A
• I've updated `CONTRIBUTING.md` or `AGENTS.md` if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — pure-Python urllib.parse, no platform-specific behaviour.
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

[alt-glitch]

Likely duplicate of #19466 — same MiniMax OAuth verification_uri rewrite (www→platform.minimax.io). #19466 is a superset that also surfaces setup wizard failures. Also related to #19461 (narrower fix for same issue).

[alt-glitch]

Likely duplicate of #19466 — same MiniMax OAuth verification_uri rewrite (www→platform.minimax.io). #19466 is a superset that also surfaces setup wizard failures. Also related to #19461 (narrower fix for same issue).

[Tranquil-Flow]

Closing in favor of #19466 — that PR covers the same www.minimax.io → platform.minimax.io rewrite (with an equivalent helper + tests) and additionally addresses #19336 (silent failure of the OAuth wizard) by replacing the catch-all SystemExit handler in _model_flow_minimax_oauth with explicit KeyboardInterrupt / SystemExit / Exception branches. That's strictly more useful than this PR. Thanks @konsisumer.