fix(model): clear stale endpoint credentials on provider switch

[helix4u]

What does this PR do?

Fixes stale inline model endpoint credentials surviving provider switches.

Root cause: several model switch paths wrote model.provider, model.default, and sometimes model.base_url directly to config.yaml without clearing inline custom endpoint fields from the previous provider. If the previous config had model.api_key, legacy model.api, or model.api_mode, those stale fields could persist after switching to Nous Portal, OpenRouter, Anthropic/API-key providers, Desktop model assignment, or gateway /model --global persistence.

This adds a shared config helper for clearing endpoint credentials and applies it across the direct write paths that bypassed or undid the existing _update_config_for_provider() cleanup.

Related/overlap:

• fix(cli): clear stale api_key/api_mode when switching away from custom provider #49362 covers the Nous/OpenRouter/API-key CLI subset; this PR covers those plus other direct provider flows, Desktop/web assignment, and gateway global picker persistence.
• fix(web): clear stale base_url/api_key on auxiliary model switch #41133 handles related auxiliary web model endpoint switching behavior.
• fix(runtime_provider, model_switch): resolve custom provider key_env from .env file #41375 handles custom provider key_env resolution from .env.
• fix(model-switch): keep working credentials when reselecting the current model #44118 handles same-provider session model switch credential preservation.

Related Issue

No GitHub issue. Found from Discord support reports around stale custom provider config surviving model switches.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/config.py: add clear_model_endpoint_credentials() for model.api_key, legacy model.api, and model.api_mode cleanup.
• hermes_cli/auth.py: route _update_config_for_provider() through the shared helper.
• hermes_cli/model_setup_flows.py: clear stale endpoint credentials in Nous, OpenRouter, Azure Foundry, Copilot, Copilot ACP, Kimi, StepFun, Bedrock/Mantle, Bedrock, generic API-key providers, and Anthropic flows.
• hermes_cli/web_server.py: clear stale main/auxiliary model endpoint credentials when switching providers through the web/Desktop assignment path.
• gateway/slash_commands.py: clear stale endpoint credentials when /model --global persists a non-custom provider selection.
• Tests cover the shared helper, Nous/OpenRouter/Anthropic flow regressions, web assignment cleanup, and gateway picker persistence cleanup.

How to Test

1. Start with config.yaml containing a custom provider under model with api_key, legacy api, and api_mode.
2. Switch to a built-in provider through the CLI picker, web/Desktop model assignment, or gateway /model --global picker.
3. Confirm the saved model config has the new provider/model values and no stale inline custom endpoint credentials.

Validation run locally:

• git diff --check -- gateway/slash_commands.py hermes_cli/auth.py hermes_cli/config.py hermes_cli/model_setup_flows.py hermes_cli/web_server.py tests/cli/test_cli_provider_resolution.py tests/gateway/test_model_picker_persist.py tests/hermes_cli/test_update_config_clears_custom_fields.py tests/hermes_cli/test_web_server.py
• .venv/bin/python -m py_compile hermes_cli/config.py hermes_cli/auth.py hermes_cli/model_setup_flows.py hermes_cli/web_server.py gateway/slash_commands.py tests/cli/test_cli_provider_resolution.py tests/hermes_cli/test_update_config_clears_custom_fields.py tests/hermes_cli/test_web_server.py tests/gateway/test_model_picker_persist.py
• Direct .venv/bin/python helper/web assignment regression probe: passed
• Direct .venv/bin/python OpenRouter/Anthropic flow regression probe against temp HERMES_HOME: passed

I did not run the full pytest suite in this WSL checkout.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: WSL2/Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — platform-independent config write path
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Direct regression checks passed for the helper/web assignment path and OpenRouter/Anthropic flow writes against temporary Hermes homes.

[alt-glitch]

Related: #49362 (concurrent competing fix for the same stale-credential bug, filed ~90s later by a different author — it covers the same _model_flow_nous path plus _model_flow_openrouter and _model_flow_api_key_provider, using a model_cfg.pop(...) mechanism rather than this PR's load_config() reload), #8571 (earlier open fix for stale api_key on custom-provider switch).

Both this PR and #49362 fix the _model_flow_nous regression where switching from a custom provider to Nous Portal reinstated the stale model.api_key/model.api_mode. This PR is scoped to the Nous picker path only; #49362 is broader-scope and uses a different mechanism. Not a duplicate — cross-linked for reviewer navigation.

[teknium1]

Merged via #49380 (#49380). Your two commits were cherry-picked onto current main with authorship preserved via rebase-merge — see c253b07 and 95a3aff. Thanks for triaging the report, finding the root cause, and authoring the comprehensive shared-helper fix across all the provider-switch paths.