fix(auth): return exhausted credential key instead of empty string

[liuhao1024]

Summary

Fixes #40960

When all credential pool entries are in exhaustion cooldown (e.g. after 429), _resolve_api_key_provider_secret() returns an empty api_key via pool.peek() → None → ("", ""). The empty key causes a misleading 401 Unauthorized from the upstream API instead of the real 429/402 error.

Changes

hermes_cli/auth.py — After pool.peek() returns None (all entries in cooldown), fall through to iterate pool._entries and return the first entry's key with a logger.warning. This ensures the upstream API returns the actual error code and message.

Before

429 quota exhausted → key marked exhausted → next session: peek() = None → api_key="" → 401 Unauthorized ❌

After

429 quota exhausted → key marked exhausted → next session: peek() = None → use exhausted key anyway → 429 quota exhausted ✅ (clear message)

Testing

• All 112 credential pool tests pass (python -m pytest tests/ -k credential_pool)
• The one pre-existing failure in test_anthropic_adapter.py::TestRunOauthSetupToken is unrelated (MagicMock type issue)

[teknium1]

Thanks for addressing a live resolver failure. Current main still has the reported path: hermes_cli/auth.py:600-609 calls pool.peek() and returns an empty key when no entry is available.

Problems

• hermes_cli/auth.py:609 iterates all raw pool entries, including STATUS_DEAD credentials. agent/credential_pool.py:59-64 and 1467-1496 define those as permanently excluded from use; this fallback would bypass that guarantee and can resend a revoked/invalidated credential.
• The PR adds no regression coverage for the peek() is None path. Existing tests at tests/tools/test_credential_pool_env_fallback.py:181-214 cover only a normal selected entry and an empty pool.

Suggested changes

• Gate the fallback on entry is None and restrict it to explicitly STATUS_EXHAUSTED entries, never STATUS_DEAD.
• Add tests for all-exhausted returning a key and all-DEAD remaining unresolved.

This is an automated hermes-sweeper review.

[teknium1]

This raw loop also considers STATUS_DEAD entries. CredentialPool._available_entries() deliberately excludes DEAD credentials permanently (agent/credential_pool.py:1467-1496), so restrict this fallback to entries explicitly marked exhausted; otherwise a revoked/invalidated credential can be sent again.