fix(auth): support removing all pooled credentials

[tt-a1i]

Summary

• add hermes auth remove <provider> all to remove every pooled credential for a provider
• reuse the existing credential source cleanup/suppression path for each removed entry so env/device-code sources stay removed
• update CLI/help text and cover exact-label/ambiguous-label all cases

Refs #49002 (adjacent auth remove all CLI gap; this does not fix the Copilot scope-validation behavior described by the main issue).

Tests

• pytest tests/hermes_cli/test_auth_commands.py tests/agent/test_credential_pool.py -q
• python -m hermes_cli.main auth remove --help
• git diff --check

[teknium1]

Thanks for preserving the existing removal and suppression path for each deleted entry. The current-main implementation only removes one resolved target at hermes_cli/auth_commands.py:442-477, so the command gap is real; the PR's reverse-order loop avoids index shifting and the all collision guard aligns with CredentialPool.resolve_target() precedence at agent/credential_pool.py:1707-1730.

Problems

• Public docs remain index-only at website/docs/reference/cli-commands.md:501-514 and website/docs/user-guide/features/credential-pools.md:107-118, despite this adding a user-facing destructive command form.

Suggested changes

• Document hermes auth remove <provider> all in both references, alongside the existing single-index form.

Automated hermes-sweeper review.