fix(auth): send Nous refresh token via header

[shannonsands]

Summary

• send Nous Portal OAuth refresh tokens via the x-nous-refresh-token header
• keep grant_type and client_id in the form body
• add a regression test that verifies the refresh token is not sent in form data

Why

NemoClaw/OpenShell credential placeholder substitution can safely rewrite headers, but not application/x-www-form-urlencoded request bodies. The Nous account service now accepts refresh tokens through x-nous-refresh-token, so Hermes can use that path without exposing raw refresh tokens to sandbox-side body rewriting.

Tests

• .venv/bin/python -m pytest tests/hermes_cli/test_auth_nous_provider.py -q
• .venv/bin/python -m py_compile hermes_cli/auth.py tests/hermes_cli/test_auth_nous_provider.py
• ruff check hermes_cli/auth.py tests/hermes_cli/test_auth_nous_provider.py
• git diff --check

[liuhao1024]

Code Review: send Nous refresh token via header

The auth change itself looks correct — moving the refresh token from the form body to the x-nous-refresh-token header makes sense for sandbox credential substitution.

Test assertion bug (blocking)

test_refresh_token_exchange_sends_refresh_token_header will fail at runtime:

class _FakeResponse:
    status_code = 200
    def json(self):
        return {"access_token": "***", "refresh_token": "***"}

But the test asserts:

assert payload["access_token"] == "access-2"

The _FakeResponse.json() returns "***", not "access-2". Either the mock return value or the assertion needs to be updated to match.

[shannonsands]

liuhao1024 updated test