fix(gateway): expand fallback env references

[LeonSGP43]

Summary

Fixes #20974.

Gateway mode had two raw config.yaml fallback readers that skipped the config env expansion step used by the CLI loaders. When fallback_model.api_key or fallback_providers[].api_key contained ${VAR}, the literal placeholder could reach fallback client creation and fail authentication.

This PR expands env references after gateway fallback YAML reads in:

• _try_resolve_fallback_provider() for auth-fallback runtime resolution
• GatewayRunner._load_fallback_model() for the fallback model chain passed to AIAgent

Tests

• scripts/run_tests.sh tests/gateway/test_auth_fallback.py (4 passed, 4 warnings)
• python -m py_compile gateway/run.py tests/gateway/test_auth_fallback.py
• git diff --check

[alt-glitch]

Competing fix with #20980 — both address #20974 (gateway fallback env expansion). This PR expands the entire config dict early, while #20980 expands only the fallback sub-dict after extraction. Maintainer to pick one.

[liuhao1024]

Test assertion looks incorrect — the expected value won't match.

In test_load_fallback_model_expands_env_references, the env var is set to "resolved-model-key", but the assertion expects "resolv...-key".

_expand_env_vars does a straightforward ${VAR} → os.environ[VAR] substitution with no masking/redaction, so the expanded value should be "resolved-model-key".

assert GatewayRunner._load_fallback_model() == {
    "provider": "custom",
    "model": "deepseek-chat",
-   "api_key": "resolv...-key",
+   "api_key": "resolved-model-key",
}

[teknium1]

Thanks for identifying the gateway fallback expansion gap. The problem remains on current main, but this branch needs a targeted salvage because the fallback implementation moved.

Problems

• Current auth fallback reads raw YAML and passes entry["api_key"] through as explicit_api_key without expansion (gateway/run.py:1952-1969).
• Current agent fallback loading also returns raw merged entries (gateway/run.py:5002-5006). get_fallback_chain() merges and copies entries only; it does not expand templates (hermes_cli/fallback_config.py:51-72).
• The diff conflicts with main and targets earlier locations. Main now has _load_gateway_runtime_config() as the shared expanding loader (gateway/run.py:2376-2393), while existing expansion tests do not cover fallback loading (tests/gateway/test_runtime_config_env_expansion.py:27-120).

Suggested changes

• Reapply the behavior against the current fallback-chain readers, preferably via _load_gateway_runtime_config() or expansion immediately before get_fallback_chain(); include the live refresh reader at gateway/run.py:5040.
• Add regression tests for both auth fallback and _load_fallback_model() with ${VAR} fallback credentials.

Automated hermes-sweeper review.