fix(auth): share xAI OAuth state across profiles

[thunderfight127-svg]

Summary

• add a shared xAI OAuth auth store for named profiles so rotated refresh tokens are written to a single cross-profile source
• keep profile auth.json files from storing their own long-lived xAI token copies when shared store mode is enabled
• preserve existing profile/root fallback and write-through behavior for non-shared-store flows
• document the shared-store behavior for SuperGrok/Premium+ OAuth setups

Why

xAI can rotate refresh_token during OAuth refresh. When multiple Hermes profiles read different copies of the same grant, one profile can refresh and revoke the token another profile still holds. A shared store makes the OAuth grant effectively singleton across named profiles.

Tests

• /home/thunderfight127/.hermes/hermes-agent/venv/bin/python -m py_compile hermes_cli/auth.py agent/credential_pool.py
• /home/thunderfight127/.hermes/hermes-agent/venv/bin/python -m pytest tests/hermes_cli/test_auth_xai_oauth_provider.py tests/tools/test_web_providers_xai.py -o 'addopts=' -q

Result: 124 passed.