fix(auth): handle Nous Portal token expiry with refresh + graceful error (#58572)

[SquabbyZ]

Fixes #58572

Summary

The gateway crashed when its Nous Portal token expired — no auto-refresh, no user-facing recovery path. The whole gateway process went down with it.

What changed

• hermes_cli/auth.py: catches the 401/403 token-expired response, triggers the refresh-token flow when available, retries the request. When refresh fails, surfaces a clear error to the operator rather than crashing the gateway.
• Circuit breaker prevents retry-looping on a permanently-bad token.
• New tests/auth/test_portal_token_expiry.py covers auto-refresh, no-refresh graceful error, and circuit-breaker behavior.

Platforms tested

• Linux (CI-equivalent)

AI-assisted contribution

This PR was drafted as part of an automated contribution sweep driven by https://github.com/SquabbyZ/peaks-loop. The original sub-agent was interrupted by a token-plan outage; this commit was recovered from the worktree state.

[teknium1]

Thanks for the focused auth recovery work. An automated hermes-sweeper review found that current main already provides the requested Nous token-expiry behavior through later auth recovery work.

• hermes_cli/auth.py:5727-5822 refreshes an unusable Nous inference JWT and persists the rotated credentials.
• hermes_cli/auth.py:5769-5782 quarantines terminal refresh failures so invalid credentials are not replayed.
• hermes_cli/auth.py:5703-5719 re-reads the shared Nous state under its lock before treating an empty local access token as terminal; this was added in ca6513542 and directly covers the concurrent rotation failure reported in [Bug]: Gateway crashes on Nous Portal token expiry with no remote recovery path #58572's discussion.
• tests/hermes_cli/test_auth_nous_provider.py:1957-2005 covers the empty-local-token shared-store recovery path.

Closing as implemented on main. This is an automated hermes-sweeper review.