fix(auxiliary): refresh auto-routed Copilot credentials

[LeonSGP43]

Summary

Fixes #20832.

When auxiliary routing is configured as provider: auto, Hermes can still resolve the actual selected client to Copilot. If the short-lived Copilot IDE/API token expires, the existing auth retry path sees only resolved_provider == "auto", skips provider-specific refresh, and can keep reusing a stale cached auto client.

This PR keeps the fix narrow:

• infers the concrete auth-refresh provider from the selected auxiliary client's base_url
• refreshes Copilot token-exchange credentials by clearing the cached exchanged JWT and re-running exchange_copilot_token()
• evicts the original auto route cache when the concrete refresh provider differs from the route provider
• retries once through the concrete provider for sync and async auxiliary calls
• allows async auxiliary calls to carry main_runtime through the same cache/refresh path as sync calls
• recognizes the reported HTTP 401: ... unauthorized text as an auth error, even when an SDK exception does not expose status_code

Verification

• scripts/run_tests.sh tests/agent/test_auxiliary_client.py -k "is_auth_error or auto_routed_copilot or refresh_provider_credentials_refreshes_copilot or refreshes_codex_on_401 or refreshes_anthropic_on_401 or retries_nous_after_401" -> 11 passed, 4 warnings
• scripts/run_tests.sh tests/agent/test_auxiliary_client.py -> 138 passed, 4 warnings
• git diff --check

Non-goals

• Does not change the auxiliary fallback ordering.
• Does not add repeated retries; this keeps the existing single-refresh retry shape.
• Does not change non-auth payment/rate-limit fallback behavior.

[alt-glitch]

Duplicate of #20837 — both fix #20832 (auto-routed Copilot credential refresh on 401) by inferring concrete provider from base_url and re-running token exchange. Same files changed (agent/auxiliary_client.py).

[teknium1]

Closing — the auto-routed Copilot credential refresh landed via PR #59837 (salvage of #20837 by @fanyangCS, the earlier submission of the same fix). The merged version infers the backend from the client base URL, covering Copilot/Codex/Anthropic/Nous auto routes. Thanks for the contribution!