fix(vertex): detect ADC across model pickers

[datalounaesportinc-droid]

What does this PR do?

Makes Google Vertex AI configured through Application Default Credentials (ADC) consistently visible across Hermes' generic auth status, task/model pickers, and the Desktop Providers UI.

The Vertex runtime already worked because agent.vertex_adapter resolves ADC and project configuration. Discovery paths did not share that logic: they only checked the legacy API-key/OAuth registries, so a working Vertex setup could still appear unauthenticated and be omitted from cron/auxiliary model selectors.

This fix uses the runtime provider registry as the auth-type source of truth and the existing fast has_vertex_credentials() structural detector. It does not mint a token or perform network I/O when a picker opens.

Related: #56687. This overlaps with #57399 and #61933, but also covers the generic get_auth_status() path and the Desktop /api/env Connected badge. Unlike #57399, picker discovery remains structural-only rather than calling get_vertex_config() and minting an OAuth token.

Related Issue

Related to #56687.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)

Changes Made

• hermes_cli/auth.py
  • Resolve plugin-backed auth types through providers.get_provider_profile().
  • Report Vertex as authenticated when its existing ADC/project detector succeeds.
• hermes_cli/model_switch.py
  • Surface Vertex in authenticated provider lists used by cron and auxiliary task model selectors.
  • Keep discovery fast and offline by using has_vertex_credentials().
• hermes_cli/models.py
  • Put Vertex's curated Gemini models in the shared provider catalog so setup and task pickers use one source.
• hermes_cli/web_server.py
  • Mark the Desktop Vertex provider card Connected when ADC/project configuration is available, even without VERTEX_CREDENTIALS_PATH.
  • Run the detector inside the requested profile scope.
• Tests
  • Cover generic auth status, authenticated picker payload, shared model catalog, and the Desktop ADC Connected badge.

How to Test

1. Configure a vertex: project/region and working ADC without setting VERTEX_CREDENTIALS_PATH.
2. Open a model selector for a cron or auxiliary task; Vertex should be authenticated and list:
   • google/gemini-3-pro-preview
   • google/gemini-3-flash-preview
3. Open Desktop Providers; Vertex should show Connected without exposing a credential path.
4. Run:
   • Focused suite: 174 passed
   • Full suite: GitHub CI matrix requested. The local installed pytest has no
     pytest-xdist; a serial full-suite run was stopped at 18% after 13 minutes
     rather than modifying the production Hermes venv to add test-only packages.
   • Ruff, py_compile, and git diff --check: passed

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs and documented the overlap above
• My PR contains only changes related to this fix
• I've run pytest tests/ -q and all tests pass — full matrix delegated to
  GitHub CI; the local focused suite passed 174 tests
• I've added tests for my changes
• I've tested on Ubuntu 24.04 with real Google ADC and a live Vertex request

Documentation & Housekeeping

• Documentation update — N/A; behavior and inline comments updated
• cli-config.yaml.example update — N/A; no config keys changed
• CONTRIBUTING.md / AGENTS.md update — N/A; no workflow or architecture change
• Cross-platform impact considered; discovery is profile-scoped and filesystem/config-only
• Tool descriptions/schemas update — N/A

[tonydwb]

Code Review Summary

Verdict: Approved

Clean fix matching its description. No security issues. No debug artifacts.

[teknium1]

Thanks for addressing a real gap: current main still excludes plugin-backed Vertex from generic auth status (hermes_cli/auth.py:6431-6441), canonical picker discovery (hermes_cli/model_switch.py:1981-2010), and the Desktop Connected calculation (hermes_cli/web_server.py:6292-6299).

Problems

• The proposed has_vertex_credentials() integration still misses an ADC-only setup whose project comes from google.auth.default(): runtime supports that at agent/vertex_adapter.py:152-174, while the structural detector returns true only for a credential path or explicit project override at agent/vertex_adapter.py:216-228.
• The proposed two-model catalog is incomplete relative to the six models documented for the picker at website/docs/guides/google-vertex.md:91-96. The linked PR fix(vertex): add curated model list so /model picker enumerates vertex models #66886 is separate curated-fallback work and should be reconciled so Vertex has one current catalog.
• The exact catalog assertion added to tests/hermes_cli/test_vertex_provider.py is a change-detector test; AGENTS.md requires behavior/invariant coverage instead.

Suggested changes

• Cover ADC with its project supplied by the credential chain, without acquiring a token during picker discovery.
• Consolidate the curated catalog with fix(vertex): add curated model list so /model picker enumerates vertex models #66886 and the Vertex guide.
• Test picker/authentication plumbing and catalog invariants rather than exact model snapshots.

Automated hermes-sweeper review.