fix(auth): share xai oauth state across profiles

[thunderfight127-svg]

Summary

• add a shared xAI OAuth token store for named Hermes profiles
• route xAI OAuth reads, writes, refreshes, and credential-pool singleton sync through the shared store
• keep classic single-home auth.json behavior compatible and document the named-profile behavior

Test plan

• git diff --check
• python -m py_compile hermes_cli/auth.py agent/credential_pool.py
• .venv/bin/python -m pytest tests/hermes_cli/test_auth_xai_oauth_provider.py tests/agent/test_credential_pool.py tests/agent/test_credential_pool_routing.py tests/tools/test_credential_pool_env_fallback.py -q -o 'addopts='

[alt-glitch]

This overlaps heavily with #28375 (fix(auth): share xAI OAuth refresh across profiles), which takes the same approach (shared root auth store + dedicated xAI OAuth lock + credential_pool sync) and is broader in scope. #33284 was already closed as a duplicate of #28375. Suggest consolidating on #28375.

[thunderfight127-svg]

Thanks for pointing this out. Confirmed this overlaps with #28375, and #28375 is the better consolidation target since it is broader and already covers the shared xAI OAuth refresh path plus credential_pool/docs. I’ll close this PR as a duplicate rather than split reviewer attention. If any smaller test/doc cleanup from this branch is still useful, I can propose it against #28375 separately.