feat(cli): show official OAuth quota via hermes usage

[lorencato23]

Summary

Add a non-interactive official quota surface so users do not have to open ChatGPT / Claude / OpenRouter to see remaining 5h and weekly allowance.

• hermes usage [provider] [--json]
• one-line summary on hermes auth status <provider>
• one-line summary on hermes status --all

Reuses fetch_account_usage() (Codex, Claude OAuth, OpenRouter, Nous). No new provider endpoints. SuperGrok / xai-oauth prints unsupported because xAI does not publish a quota API.

This is not the CLI/TUI status-bar work in #44506 / #53375.

Closes #33094
Related: #57476

Test plan

• python3 -m pytest tests/hermes_cli/test_usage_cmd.py tests/agent/test_account_usage.py tests/hermes_cli/test_status.py -q (27 passed)
• hermes usage openai-codex --json against a signed-in Codex account
• hermes auth status openai-codex shows a usage line
• hermes usage grok reports unsupported without making an HTTP call

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

Overall: solid CLI surface for official quota data, with genuinely good test coverage (aliases, dispatch, exit codes, compact-line formatting). Points to consider:

1. agent/account_usage.py (compact_account_usage_line) — the one-line renderer does string surgery on another formatter's output: _format_reset(window.reset_at).split(' (', 1)[0] to drop the local-clock parenthetical. If _format_reset's wording ever changes (or is localized), this silently degrades or leaks half-sentences into hermes status output. Cleaner: give _format_reset an explicit flag (e.g. `include_local=False) so the compact surface requests what it wants instead of parsing prose.

2. hermes_cli/usage_cmd.py (usage_command`, aggregate text path) — when no provider reports ok (fresh install), the only output is the hardcoded "Grok unsupported" line and exit code 0, which reads as if Grok is the notable problem rather than "nothing configured". Consider an explicit "(no providers with usable quota credentials)" line, or include unavailable rows in text mode too.

3. hermes_cli/status.py:309/324 — usage lines are wired for nous and codex only; anthropic/openrouter status sections don't get them even under --all while logged in. If that asymmetry is deliberate (e.g., those fetches are slower), a brief comment would prevent "forgot" bug reports; otherwise add the two missing call sites for consistency.

4. hermes_cli/status.py:31-42 — status --all now performs synchronous network fetches per logged-in provider; with both nous and codex configured this adds their full upstream latency to every --all invocation. Worth confirming the underlying fetch timeouts are tight enough that --all stays snappy.

Minor: f"📈 Account limits has no placeholders — plain string.