fix(desktop): route global remote profile REST calls

[helix4u]

What does this PR do?

Fixes Desktop/global-remote profile-scoped REST forwarding.

The renderer already sends profile-scoped REST calls with request.profile, including /api/model/info after a profile switch. Electron used that profile only to select a backend connection. In local pooled-backend mode that works because each profile backend is already scoped by its own HERMES_HOME.

In global remote/Docker mode, every profile resolves to the same remote backend, so forwarding /api/model/info without ?profile=<active profile> makes the backend read the default profile config. That leaves Desktop/dashboard model status showing the default profile model even after switching to another profile.

This adds a small path helper that appends the active profile query only for global remote mode. Local pooled backends and explicit per-profile remote overrides keep the previous behavior.

Brooklyn also caught the matching backend gap for renderer OAuth routes. Those routes were already marked profile-scoped in apps/desktop/src/hermes.ts, but hermes_cli/web_server.py ignored profile, so global remote OAuth status/start/disconnect flows could still read or write the default profile. This PR now carries OAuth provider routes through profile scope and stores the profile on pending OAuth sessions so delayed background token writes land in the profile that started the login.

Related Issue

Related Discord support thread: https://discord.com/channels/1053877538025386074/1516276393732735006

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• apps/desktop/electron/connection-config.cjs: add pathWithGlobalRemoteProfile(...) for profile query forwarding in global remote mode.
• apps/desktop/electron/main.cjs: apply the helper before forwarding hermes:api REST requests.
• hermes_cli/web_server.py: accept/apply profile on OAuth provider routes and persist the session profile for delayed OAuth completion workers.
• hermes_cli/auth.py: key the short-lived Nous auth-status cache by auth-store path as well as mtime, so profile-scoped status reads do not share one process memo.
• tests/hermes_cli/test_web_oauth_dispatch.py: cover OAuth status profile scoping, OAuth start session profile persistence, and delayed Codex OAuth persistence inside the session profile.
• tests/hermes_cli/test_nous_auth_status_cache.py: cover cache separation across profile auth-store paths.
• tests/test_tui_gateway_server.py: isolate the notification poller queue in the failing test (6) case so cross-test queue state cannot produce duplicate watch-match status emissions.
• apps/desktop/electron/connection-config.test.cjs: cover global remote append behavior and local/per-profile remote skip behavior.

How to Test

1. Configure Desktop with a global remote/Docker backend.
2. Configure Default and another profile, such as iris, with different model.default values.
3. Switch the Desktop profile rail from Default to iris.
4. Verify profile-scoped REST calls such as /api/model/info are forwarded with ?profile=iris and the footer/model status reflects the selected profile.
5. Open Accounts/OAuth provider status or start an OAuth flow after switching profiles and verify the backend reads/writes the selected profile, not the default profile.

Validation run:

• node --test electron/connection-config.test.cjs from apps/desktop passes: 50 tests.
• python -m py_compile hermes_cli/auth.py hermes_cli/web_server.py tests/hermes_cli/test_web_oauth_dispatch.py tests/hermes_cli/test_nous_auth_status_cache.py passes.
• scripts/run_tests.sh -j 4 tests/test_tui_gateway_server.py passes: 273 tests.
• git diff --check -- <changed PR files> passes. A repo-wide git diff --check still reports unrelated local-only AGENTS.md trailing whitespace in this checkout.
• Earlier npm run test:desktop:platforms reached and passed the updated connection-config.test.cjs coverage, then failed in an unrelated existing shard: electron/windows-child-process.test.cjs / desktop background child processes opt into hidden Windows consoles with AssertionError [ERR_ASSERTION]: missing call site: execFileSync(pyExe.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: WSL/Linux with Node desktop unit tests and targeted runner checks

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Support report was reproduced from the code path rather than a local Desktop run: global remote mode dropped the renderer's request.profile before forwarding REST calls to the backend.

[OutThisLife]

One profile-scoping gap looks like it remains in global remote mode: this change forwards the active profile as ?profile=..., but not every renderer profile-scoped route consumes query profile on the backend.

For example, apps/desktop/src/hermes.ts sends profileScoped() for the /api/providers/oauth* calls, but the matching OAuth provider endpoints in hermes_cli/web_server.py do not accept/apply a profile parameter. In global remote mode those calls would still read/write the default profile's OAuth state after switching profiles, which is the same bug class this PR fixes for model/config/env routes.

I think the fix needs to either make those OAuth provider routes carry profile scope through _profile_scope(...) as appropriate, or avoid marking them profile-scoped in the renderer if they are intentionally global.

[helix4u]

@OutThisLife fixed in the latest push.

OAuth provider routes now accept/apply profile, and pending OAuth sessions store that profile so delayed PKCE/device-code/loopback completion workers persist tokens under the profile that started the login. I also keyed the short-lived Nous auth-status cache by auth-store path so profile-scoped status reads cannot share the default profile memo.

Also fixed the existing test (6) failure by isolating test_notification_poller_emits_distinct_watch_matches_once from the process-wide completion queue; targeted scripts/run_tests.sh -j 4 tests/test_tui_gateway_server.py passes locally.