feat(proxy): add OpenAI Codex OAuth pool upstream

[darkyy92]

Summary

• add an openai-codex upstream to hermes proxy
• centralize Codex OAuth refresh and credential-pool selection for isolated local clients
• rotate safely on 401/429 and fail closed when all credentials are exhausted
• require owner-only per-client key configuration for the Codex proxy
• preserve native Responses API/SSE semantics without logging request content

Why

Multi-user Hermes hosts need Linux-user isolation for mail, memory, 1Password, and other per-person secrets. Copying rotating Codex OAuth tokens into every user home is unsafe and operationally fragile. A single ops-owned proxy lets isolated Hermes clients share company-owned subscription accounts while keeping refresh tokens centralized.

Safety

• client key file must be mode 0600
• constant-time client token comparison
• finite retries, exact failed-credential refresh under concurrency
• arbitrary upstream error messages are not persisted
• no metered fallback
• existing Nous/xAI proxy behavior remains backward-compatible

Verification

• 150 proxy + credential-pool tests passed locally
• independent review found no remaining blockers
• real local systemd proxy E2E returned response.completed and exact expected output through OpenAI Codex OAuth
• two isolated temporary Hermes homes completed named-custom-provider codex_responses calls through the same proxy

[teknium1]

Thanks for building this on the existing proxy-adapter and credential-pool surfaces.

Problems

• hermes_cli/proxy/server.py:354-361 records every request's configured client label, a stable derived fingerprint, model, and status. This is per-client usage attribution, but AGENTS.md:118-121 requires a generic user-facing opt-in before adding attribution logging.
• The public proxy guide remains inaccurate: website/docs/user-guide/features/subscription-proxy.md:75-77 says only nous and xai are shipped. It also needs the Codex-only key-file requirement and supported-path behavior.

Suggested changes

• Remove the attribution log. A generic opt-in mechanism would need to exist before this data can be recorded.
• Update the subscription-proxy documentation for openai-codex, /responses//models, and --client-keys-file mode 0600.

This is an automated hermes-sweeper review.

[teknium1]

Please remove this per-request client-label/fingerprint/model log. AGENTS.md:118-121 prohibits new usage attribution without the generic user-facing opt-in gate; this proxy does not provide that prerequisite.

[darkyy92]

Addressed in ea35e78:

• Removed the per-request client label/fingerprint/model/status attribution log and the now-unused request-model parsing. Invalid client-key attempts retain only a generic operational warning.
• Updated the proxy guide to list openai-codex, document /v1/responses and /v1/models, require --client-keys-file, and explain the owner-only 0600 check. Also corrected the LAN and architecture notes for provider-specific auth/path behavior.
• Updated the proxy behavior test to assert client labels, fingerprints, model names, tokens, and request content are absent from logs.

Verification: 49 passed across tests/hermes_cli/test_proxy.py and tests/hermes_cli/test_proxy_openai_codex.py; Ruff check/format and git diff --check pass.