fix(model): sort configured providers first in hermes model wizard

[Mibayy]

Summary

Closes #3226

hermes model showed all providers in a flat alphabetical list regardless of whether the user had credentials for them. Someone with only kimi-coding configured had to scroll past 14 irrelevant entries.

list_available_providers() in hermes_cli/models.py already tested for credentials on every provider and returned an authenticated field — but cmd_model() in main.py never used it. This PR wires them together.

Behaviour change

Before:

Select provider:
  OpenRouter (100+ models, pay-per-use)
  Nous Portal (Nous Research subscription)
  OpenAI Codex
  GitHub Copilot ACP
  GitHub Copilot
  Anthropic
  ...14 entries, no indication which ones are configured...
  Kimi / Moonshot  ← currently active

After:

Select provider:
  Kimi / Moonshot  ← currently active
  ──── unconfigured ────
  OpenRouter (100+ models, pay-per-use)  [not configured]
  Nous Portal (Nous Research subscription)  [not configured]
  OpenAI Codex  [not configured]
  ...

Configured providers float to the top; unconfigured ones are marked [not configured] and listed below. Nothing is hidden — hermes model is also the setup flow for new providers, so all remain selectable.

Implementation

• Call list_available_providers() once to get auth status for each provider ID.
• Split provider list into configured and unconfigured during the ordering pass.
• Active provider always goes first in configured with the existing ← currently active marker.
• Named custom providers from config.yaml are always treated as configured (they have an explicit base_url).
• remove-custom sentinel moved to always-last position (was previously appended to the main list before reordering, which worked but was fragile).

Tests

1661 gateway + session + run_agent tests pass, 21 skipped. The 2 pre-existing failures (test_toolset_has_keys_for_vision_accepts_codex_auth, test_custom_setup_clears_active_oauth_provider) reproduce on main without this patch.

[teknium1]

Thanks for targeting a real model-picker usability gap. The issue remains present on current main: hermes_cli/main.py:3003-3033 constructs the provider picker from all canonical providers and only prioritizes the active row, while hermes_cli/models.py:1672-1713 already exposes per-provider authenticated state.

Problems

• The patch was written before provider grouping. Current main folds slugs into multi-member rows via group_providers() (hermes_cli/main.py:3003; hermes_cli/models.py:1134-1160), so the flat partition in this diff does not define how a group with mixed credential status should be ordered or labeled.
• The diff contains no regression test. Existing group behavior is covered in tests/hermes_cli/test_provider_groups.py:63-101.

Suggested changes

• Rework the ordering at the current group-row layer and define mixed-status group behavior.
• Add a focused picker test covering configured-first ordering, the active group/provider, unconfigured reachability, and custom/action rows.

Automated hermes-sweeper review.