fix(dashboard-auth): route session refresh with provider hint and preserve multi-provider fallback

[teknium1]

Summary

Mixed-provider dashboard deployments no longer force a re-login on every access-token expiry: a non-secret hermes_session_provider hint cookie routes refresh/verify to the provider that minted the session, and the refresh chain now continues past per-provider rejections instead of aborting on the first RefreshExpiredError.

Root cause: session cookies carried no provider identity, and _attempt_refresh() treated the first provider's rejection as authoritative — but a foreign opaque RT is indistinguishable from a dead one, so in a stacked [basic, nous] deploy the wrong provider rejected first and the user was bounced to /login.

Salvage of #61809 by @unsupportedpastels (commits cherry-picked with authorship preserved). Subsumes #40847 by @Dusk1e, who first submitted the refresh-chain-continuation half a month earlier — credit to both.

Changes

• hermes_cli/dashboard_auth/cookies.py: new hermes_session_provider cookie (HttpOnly, same hardening/prefix variants as session cookies) + read/set/clear helpers
• hermes_cli/dashboard_auth/middleware.py: hint prefers via stable sort (never filters — stale/unknown hints fall back to the full scan); refresh continues past RefreshExpiredError; ProviderError with no successful refresh → 503 without clearing cookies; legacy sessions backfill the hint on the next valid request
• hermes_cli/dashboard_auth/routes.py: OAuth callback + password login persist the provider hint at session mint
• hermes_cli/dashboard_auth/base.py: docstrings updated for the new rejection/outage semantics
• Tests: hint routing, wrong-provider isolation, stale/unknown-hint fallback, outage-503-preserves-cookies, legacy migration

Validation

	Before	After
RT owned by later provider	first provider rejects → forced re-login	hinted/owning provider refreshes, request served
Stale/unknown hint	n/a	full provider scan unchanged
Provider outage during refresh	cookies cleared, re-login	503, cookies preserved
Auth suite (run_tests.sh, 3 files)	—	96/96 passed

Infographic