fix(auth): keep Codex OAuth pool accounts distinct

[glesperance]

Rationale

hermes auth add openai-codex must preserve independently added Codex OAuth accounts. The bug this guards against is a second login collapsing earlier pool entries into the latest account, so credential rotation appears configured but repeatedly uses the same account.

Summary

• Adds a shared SOURCE_MANUAL_DEVICE_CODE constant for manually added device-code credentials.
• Uses that constant when adding Codex OAuth credentials so the add path remains explicit and does not drift back to the singleton device_code source.
• Adds regression coverage for adding two distinct Codex OAuth accounts and reloading the pool without collapsing them.

Test Plan

• python -m pytest tests/hermes_cli/test_auth_commands.py::test_auth_add_codex_oauth_persists_pool_entry tests/hermes_cli/test_auth_commands.py::test_auth_add_codex_oauth_keeps_distinct_pool_accounts -q
• python -m pytest tests/hermes_cli/test_auth_commands.py -q
• python -m ruff check agent/credential_pool.py hermes_cli/auth_commands.py tests/hermes_cli/test_auth_commands.py
• git diff --check

[teknium1]

Merged via #42316. Your SOURCE_MANUAL_DEVICE_CODE constant and the direction of this PR — making hermes auth add openai-codex keep accounts distinct rather than collapsing them into the singleton — are exactly what we shipped, with you credited as co-author on the add-path commit (c78b3e1 on main, Co-authored-by: glesperance).

The literal diff here couldn't be cherry-picked cleanly because the Codex add block in auth_commands.py was rewritten on main since this branched (it now routes through _save_codex_tokens). So we reimplemented your intent against current code: a distinct PooledCredential per account via pool.add_entry(), matching the xai/gemini/qwen patterns, plus mark_provider_active_if_unset() so the first add still sets the active provider. Your regression test (two distinct accounts stay distinct) is in the merged suite. Thanks!