fix: honour HERMES_LLM_BASE_URL env var when provider-specific base_url_env_var is absent

[OmarB97]

Why

MeshBoard's stream-tap launcher creates a per-dispatch HERMES_HOME sandbox whose .env sets HERMES_LLM_BASE_URL to a local proxy URL. Hermes was ignoring this because resolve_api_key_provider_credentials() only checked the provider's own base_url_env_var (e.g. OPENCODE_ZEN_BASE_URL), not the generic HERMES_LLM_BASE_URL fallback.

When the provider-specific env var is unset, fall back to HERMES_LLM_BASE_URL so the stream-tap proxy is actually used.

What changed

• hermes_cli/auth.py: In both resolve_api_key_provider_credentials() and get_api_key_provider_status(), after checking pconfig.base_url_env_var, also check HERMES_LLM_BASE_URL as a fallback.

How to review

1. Verify the two functions now check HERMES_LLM_BASE_URL when env_url is empty.
2. Confirm this is a safe additive change — it only activates when the provider-specific env var is absent.

Evidence

Manual test with a sandbox .env containing HERMES_LLM_BASE_URL=http://127.0.0.1:58017/v1:

• Before: resolve_api_key_provider_credentials("opencode-zen") returned base_url="https://opencode.ai/zen/v1"
• After: returns base_url="http://127.0.0.1:58017/v1"

Verification

• Syntax check passes (python -m py_compile hermes_cli/auth.py)
• No behavioural change when HERMES_LLM_BASE_URL is unset
• MeshBoard stream-tap diagnostic task tracks full fix chain

Risks / gaps

• None — this is a pure fallback that only activates when the provider-specific base URL env var is absent.

Collaborators

• Participants:
  • Omar (OmarB97) — author, fix
• Reviewers: meshboard-autopilot

[alt-glitch]

Related to #18757 (resolve_api_key_provider_credentials uses os.getenv for base_url_env_var) and #18948 (fix via get_env_value). Note: this PR shares a fork branch with closed PR #33996 — most files_changed are unrelated to the actual fix (only hermes_cli/auth.py changes are relevant).