fix(cli): deprecated hermes login fails gracefully for any provider

[kshitijk4poor]

The bug

`hermes login` was deprecated in favor of `hermes auth` / `hermes model` — its handler (`login_command` in `hermes_cli/auth.py`) just prints a redirect and exits. But the subparser still validates `--provider` against a hardcoded list:

```python
choices=["nous", "openai-codex", "xai-oauth"]
```

So a user trying a valid-but-unlisted provider hits a hard argparse crash before the friendly deprecation message can run:

```
$ hermes login --provider anthropic
hermes login: error: argument --provider: invalid choice: 'anthropic'
(choose from 'nous', 'openai-codex', 'xai-oauth')
```

This is exactly the trap for someone trying to wire up Claude Pro/Max subscription auth (fully supported via `hermes model` → Anthropic → OAuth). They follow `hermes login`, get `invalid choice`, and assume the feature is broken rather than relocated. `hermes login --provider nous` at least prints the deprecation message — `anthropic` doesn't even get that far.

The fix

• Drop the restrictive `choices=` so every `--provider` value reaches the deprecation handler (which ignores the value and prints guidance to `hermes model`).
• Omit the subparser `help=` kwarg so the dead command no longer advertises itself in `hermes --help` (addresses the `--help` half of OpenAI Codex auth/model setup leaves Desktop unusable after macOS install #24756). Using `help=argparse.SUPPRESS` instead leaks a literal `==SUPPRESS==` row for a top-level subparser on Python 3.12+ (verified) — omitting `help` is the version-robust way to hide a subcommand row.
• `hermes login [--flags]` still reaches the actionable deprecation message for old scripts/aliases; `hermes login --help` shows the redirect.

Relationship to prior art

Picks up the intent of #24902 (inactivity-closed, not rejected — author said "the underlying fix still stands"), rebased onto the post-refactor parser location (`hermes_cli/subcommands/login.py`, moved by the subcommand-extraction refactor #568e12761) and extended to fix the whole bug class — any provider value, not just hiding the `--help` row. #2806 (open) migrates docs strings only; this fixes the runtime UX.

Verification (real CLI, not just unit mocks)

```
$ hermes login --provider anthropic
The 'hermes login' command has been removed.
Use 'hermes auth' to manage credentials,
'hermes model' to select a provider, or 'hermes setup' for full setup. # exit 0

$ hermes --help # no 'login' row, no ==SUPPRESS== leak
$ hermes login --help # shows the deprecation redirect (old scripts)
```

Tests

`tests/hermes_cli/test_subcommands_batch.py`:

• parametrized: `--provider {anthropic,nous,openai-codex,totally-made-up}` all route to the handler (no `invalid choice`)
• help row suppressed with no `==SUPPRESS==` leak

67 passed (batch + startup-plugin-gating). Behavior-contract tests, not snapshots.

[github-actions]

🔎 Lint report: fix/cli-login-deprecation-graceful vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 10992 on HEAD, 10992 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5791 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[alt-glitch]

Related: #24756 (underlying bug), #24902 (closed-for-inactivity prior attempt that hid the --help row — this PR rebases onto the post-refactor parser location and extends the fix to drop the restrictive choices= so any provider value reaches the deprecation handler), and #2806 (open, docs-only mechanism vs. this PR's runtime UX fix). Not a duplicate — broader scope than the closed #24902 and different mechanism from #2806.