fix(model): prevent wizard from overwriting model.base_url when adding provider

[alaamohanad169-ship-it]

What does this PR do?

When running hermes model to add/configure a provider without intending to switch the default, the wizard previously overwrote model.base_url and model.provider, breaking the previously-working default model (issue #40862).

This fix adds a confirmation prompt: 'Make your default provider? [Y/n]'

• If yes (default): proceeds with the original flow — selects model, makes it default
• If no: configures the provider (credentials, base_url) without changing the active default model

Changes Made

• hermes_cli/main.py: Added confirmation prompt in select_provider_and_model() after provider selection
• hermes_cli/main.py: Added new _configure_provider_only() function that handles provider configuration (OAuth login, API key prompt, base URL) for all provider types without switching the default

How to Test

1. Configure a provider as default (e.g., DeepSeek with base_url=https://api.deepseek.com/v1)
2. Run hermes model
3. Select a different provider (e.g., xAI Grok OAuth)
4. When prompted "Make 'xAI Grok OAuth' your default provider? [Y/n]", answer n
5. Verify the provider is configured (OAuth login completes, or API key saved)
6. Run hermes config show and verify model.provider and model.base_url are unchanged
7. Run hermes model again, select the same provider, answer y — verify it switches default

Related Issue

Fixes #40862

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Checklist

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix
• I've tested on my platform: Android/Termux

[tonydwb]

Code Review Summary

Verdict: Approved

• Fixes the stated bug: provider wizard no longer silently overwrites model.base_url when the user only intended to add credentials.
• New config-only flow is bounded and preserves existing default behavior when the explicit opt-in path is taken.
• Scope is focused and regression risk is low.

Minor consideration: openrouter and nous providers are now effectively blocked from the configure-only path and redirect users back to the full setup flow. This is a reasonable degradation to protect defaults, but should match the product intent.

Reviewed by Hermes Agent

[alt-glitch]

This is the same fix as the recently-closed #40882 (identical 'Make your default?' confirm + _configure_provider_only() approach for #40862). Flagging as duplicate so maintainers can consolidate.