refactor(web): extract custom-endpoints routes into web_routers/custom_endpoints (web_server.py god-file slice R3-C1)

[andrexibiza]

Summary

Web_server.py god-file slice R3-C1: extract the custom-endpoints family from hermes_cli/web_server.py into hermes_cli/web_routers/custom_endpoints.py (APIRouter). Part of the repo-wide large-file decomposition (tracker #78647).

What changed and why

• Moved the 13 custom-endpoint names (list/upsert/activate/delete/validate + helpers, window 7107–7472) byte-verbatim into hermes_cli/web_routers/custom_endpoints.py
• Router mounted; web_server.py re-exports all 13 (seam identity verified is-identical); the one cross-cluster helper (_apply_main_model_assignment) resolves via web_deps.late()
• Added seam-identity regression (13 names) + aggressive tests (model-id parsing shapes, api-key display redaction, env-ref detection, HTTP-failure paths)

Why this matters to users

Custom OpenAI-compatible provider endpoints are a dashboard surface users configure directly. Extracting the CRUD + validate family into a router module keeps the credential-handling behavior byte-identical (api_key vs key_env, redaction, audit names-not-values) while enabling the large-file decomposition.

Testing

• pytest tests/test_web_server_custom_endpoints_seam.py tests/hermes_cli/test_custom_provider_model_switch.py tests/gateway/test_25107_stale_base_url_api_mode.py → 27 passed
• Canonical runner: 3 files, 27 passed, 0 failed
• Seam identity 13/13; all 5 routes live on the app; literal-path precedence (/validate vs /{endpoint_id}) verified
• ruff clean · git diff --check clean · LF-only · DCO signed
• Platforms tested: Windows (native), CI-parity runner

Coordination / interlock

• Epic: Part of [COMPLETE] Large-file decomposition: 20/20 done #78647 (Shard all 20 god files)
• Related PR fix(context): thread custom_providers to all context-length resolution call sites #75738 (thread custom_providers to context-length resolution): LOW overlap — adjacent regions, disjoint code (verified during the rebase). Both compose.
• Sibling PRs: other web_server slices — disjoint clusters
• Dedup: no existing PR extracts the custom-endpoints family
• Class fix: seam test renamed to test_ prefix (CI collection) — coordinated across all six sibling PRs
• Credit: extraction pattern follows the sibling slices and the mcp.py/cron.py router precedents

Part of #78647
Part of #78628

[andrexibiza]

🔒 This shard is part of the web_server.py KILL LOCK — the permanent record of the 17,700-line whole, the mess it caused (#58576 event-loop stalls, #60800 cold-start stalls, #53972 token persistence, #71778 analytics), every shard in the wave, and every open fixer PR still fighting the surface (#50188 #71802 #54034 #76764 #71150 #67365 #65434 #65424 #78411 #75845 #68022 #62654 #76757 #68251 #51070 #73605 #73849 #73393 #71752 #77808 #46956 #74297 #77853).

Lock: posted on #78628 · Indexed by the Kill All Gods meta-issue #78647.

[alt-glitch]

This was generated by AI during triage.

Related: #79776 also extracts the custom-endpoint route family. This PR imports config helpers directly; #79776 resolves them through late-bound seams. Please consolidate or choose one approach.