refactor(auth): Disable Nous Portal legacy session key inference fallback — JWT-only

[kshitijk4poor]

What this PR does

Salvage of #33759 by @rewbs onto current main, plus two follow-up cleanup commits.

Removes the Nous Portal legacy opaque session-key inference fallback. Nous inference now accepts only inference:invoke JWTs:

• Existing usable invoke JWTs are reused (no network refresh).
• Stale or non-JWT OAuth access tokens are refreshed once via the OAuth refresh endpoint.
• The refreshed JWT is mirrored into the existing agent_key compatibility field, so older local config layouts (opaque agent_key + valid refresh token) migrate cleanly.
• When no refresh material is available, the resolver returns a clear relogin_required error (run: hermes auth add nous) rather than silently minting a legacy key.

Deleted machinery: _mint_agent_key, _choose_nous_inference_auth_path, NOUS_INFERENCE_AUTH_MODE_LEGACY, legacy scope constants, device-code scope fallback, HERMES_AGENT_USE_LEGACY_SESSION_KEYS handling, and the proxy retry-with-legacy-session-key path.

Commits / attribution

• refactor(auth): Disable Nous legacy session key fallback — @rewbs
• fix(auth): address Nous JWT fallback review — @rewbs
• test(auth): update nous jwt-only expectations — @rewbs
• refactor(auth): drop weak JWT-shape fallback in auxiliary _nous_api_key — follow-up (this salvage)
• refactor(auth): remove vestigial Nous min_key_ttl/inference_auth_mode params — follow-up (this salvage)

Follow-up 1 — _nous_api_key fallback

Removed the import-failure fallback in agent/auxiliary_client._nous_api_key that returned any 3-segment token without scope/expiry validation — a divergent reimplementation of the canonical _nous_invoke_jwt_is_usable. Since that import comes from the same module that provides resolve_nous_runtime_credentials, an import failure means the whole auxiliary Nous path is unavailable anyway; it now returns "" so the caller falls through to the clear re-auth guidance.

Follow-up 2 — dead-code removal

After the legacy path was removed, two parameters became dead surface on the Nous runtime-resolution chain:

• min_key_ttl_seconds — del'd inside refresh_nous_oauth_pure, pass-through / telemetry-only everywhere else. It controlled the now-deleted agent-key mint TTL.
• inference_auth_mode — with the legacy mode gone, AUTO and FRESH are behaviorally identical; it only fed validation + trace output, never a branch.

Removing them orphaned the supporting cluster (NOUS_INFERENCE_AUTH_MODE_AUTO/FRESH, NOUS_INFERENCE_AUTH_MODES, _normalize_nous_inference_auth_mode, DEFAULT_AGENT_KEY_MIN_TTL_SECONDS) — all deleted. Every caller updated; two tests exercising the removed surface deleted. No behavior change; net −134 LOC of dead code. Confirmed zero remaining references to all removed symbols across the codebase.

Test plan

scripts/run_tests.sh tests/hermes_cli/test_auth_nous_provider.py \
  tests/hermes_cli/test_web_oauth_dispatch.py tests/hermes_cli/test_proxy.py \
  tests/agent/test_auxiliary_client.py tests/agent/test_credential_pool.py \
  tests/run_agent/test_run_agent.py tests/hermes_cli/test_nous_inference_url_validation.py \
  tests/run_agent/test_provider_parity.py tests/hermes_cli/test_auth_commands.py \
  tests/hermes_cli/test_runtime_provider_resolution.py tests/cli/test_cli_provider_resolution.py \
  tests/hermes_cli/test_auth_profile_fallback.py

1032 passed, 0 failed. ruff clean on changed files; git diff --check clean.

Closes #33759