chore: rebase #25968 (xai-oauth) on latest main + fix review issues

[avirweb]

Rebase of am423's PR #25968 onto latest upstream main, with audit fixes for the review issues surfaced on that PR.

What this is

This is not a new feature. It's a rebase + cleanup of the existing open PR #25968 (feat/xai-oauth-first-class), which was stale and had merge conflicts. While rebasing, the following issues were also fixed:

Fixes

• Duplicate function definitions: 3 upstream xai-oauth functions (get_xai_oauth_auth_status, resolve_xai_oauth_runtime_credentials, _login_xai_oauth) were silently shadowed by the rebased versions — removed the old ones
• Wrong credential pool seeding: OAuth bearer JWT was being written into the xai API-key credential pool — removed the call
• env_vars on OAuth provider: XAI_API_KEY in env_vars could leak into the OAuth resolution path — cleared to empty
• datetime.fromisoformat Z suffix: Python <3.11 can't parse timestamps with Z suffix — normalize to +00:00
• expires_in TypeError: Unsafe int() on nullable OAuth response field — added null guard
• Suppressed credential errors: debug-level logging swallowed the clear not-logged-in AuthError — changed to warn + re-raise
• stdout pollution: print() in import helper was called from resolve_provider (non-interactive path) — replaced with logger.info

Supersedes #25968, #27144.

[alt-glitch]

Competing with #27144 (same rebase of #25968 by different author) and original #25968 (still open). Team should pick one to move forward with.

[teknium1]

Closing this one.

The premise "the official is kinda broken, this fixes it" doesn't hold up against the current state of main. xAI Grok OAuth officially landed via #26534 on May 15 and has had five follow-up hardenings merged since:

• docs(xai-oauth): add xai-oauth to provider enumeration pages #26542 — docs for xai-oauth provider enumeration
• docs(xai-oauth): add xai-oauth to provider enumeration pages #26542 / docs(xai): link OAuth-over-SSH guide from xAI provider surfaces #26610 — OAuth-over-SSH guide linkage
• fix(xai-oauth): recover from prelude SSE errors, gate reasoning replay, surface entitlement 403s #26644 — recover from prelude SSE errors, gate reasoning replay, surface entitlement 403s
• fix(xai-oauth): break entitlement-403 credential-refresh loop, bump grok-4.3 context to 1M #26664 — break entitlement-403 credential-refresh loop, bump grok-4.3 context to 1M
• fix(xai-oauth): rewrite entitlement-403 hint to not accuse subscribers #26666 / fix(xai-oauth): lead entitlement-403 hint with X Premium+ gotcha #26672 / fix(xai): drop stale X Premium+ hint from entitlement 403 surfacing #27110 — entitlement-403 hint copy fixes
• fix(auxiliary): resolve xAI OAuth compression from pool #26715 — resolve xAI OAuth compression from pool

hermes_cli/auth.py on current main has ~50+ lines of xai-oauth wiring (ProviderConfig, alias map, OAuth-capable provider set, token read/save, refresh, PKCE login flow). All of #25968's substantive content was salvaged into the official merge.

Re-rebasing #25968 wholesale on top of all that is not a useful diff shape. If something specific is still broken on current main, the right move is to file an issue with reproducible steps against the merged version (or open a narrow PR fixing the specific bug), not to re-land an old branch as a "rebase."

Thanks for tracking it — and credit to @ams432 for the original work, which is already in main.