feat(plugins): expose API server route extensions

[sasan1200]

What does this PR do?

Adds a narrow plugin extension surface for the API server:

• PluginContext.register_api_server_route(...)
• PluginContext.register_api_server_capability(...)
• PluginManager.get_api_server_routes()
• PluginManager.get_api_server_capabilities(...)

This lets plugins contribute explicit API-server routes and capability metadata without importing plugin-specific code into gateway/platforms/api_server.py. Routes are mounted after core routes and duplicate method/path registrations are skipped, so plugins cannot shadow built-in API routes.

Value/drift result: this was split out from broader local plugin work because current upstream/main has no API-server route/capability extension point, while the plugin release audit needs this host surface for real HTTP integration.

Duplicate search result: searched upstream PRs/issues for plugin API server route/capability extension work. No focused duplicate found; the closest result was a broad hook-registry PR, not a targeted API-server route/capability surface.

Conflict notes: rebased cleanly onto upstream/main at 1927ff217. While refreshing, preserved current upstream auxiliary-task plugin manager state and added duplicate-route coverage.

Related Issue

N/A

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/plugins.py: add API-server route and capability provider registration APIs.
• gateway/platforms/api_server.py: mount plugin routes after native routes and merge plugin capability metadata into /v1/capabilities.
• tests/hermes_cli/test_plugins.py: cover route/capability registration and provider failure isolation.
• tests/gateway/test_api_server.py: cover capability extension metadata, plugin route mounting, invalid route isolation, and duplicate core-route protection.

How to Test

1. PYTHONPATH="/private/tmp/hermes-agent-upstream-main" /Volumes/MIRZA/.hermes/hermes-agent/.venv/bin/python -m pytest tests/hermes_cli/test_plugins.py tests/gateway/test_api_server.py tests/gateway/test_api_server_runs.py -q -p no:xdist -o addopts= -k "api_server or capabilities or plugin"
   • Result: 259 passed, 131 warnings in 18.16s
2. /Volumes/MIRZA/.hermes/hermes-agent/.venv/bin/ruff check .
   • Result: All checks passed!

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this feature
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation — N/A
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Focused tests and ruff output are listed above. Full repository pytest was not run to completion in this local venv because unrelated collection/runtime environment issues were present (acp extra missing, protected temp-path writes, and leaked local Anthropic auth state).