fix(auth): surface real upstream 429 when all pool entries exhausted (#40960)

[hashbender]

Summary

Fix issue #40960: when all credential pool entries are in exhaustion cooldown (e.g. after a 429 quota-exhausted response), _resolve_api_key_provider_secret() silently returned an empty api_key. This caused the API request to fail with a misleading 401 Unauthorized, hiding the real cause (a 429 quota message from the provider).

Root Cause

hermes_cli/auth.py L593-605: when pool.peek() returns None (all entries in cooldown), the code returns an empty string for api_key instead of falling back to an exhausted entry.

Fix

After peek() returns None, iterate pool._entries and return the first usable key with a warning log. The upstream API then returns its real 429 with the quota-reset timestamp, giving users actionable information.

Test Plan

• Syntax check: ast.parse() passes
• Locally verified pool returns 401-masked-error before fix
• CI passes (GitHub Actions)
• Maintainer review

Related

• Closes [Bug] credential pool exhaustion causes misleading 401 instead of real 429/402 NousResearch/hermes-agent#40960
• See also Desktop model picker: credential pool exhaustion blocks provider switching after any 401 NousResearch/hermes-agent#52727 (related short-term fix proposal)

---

Mirror-of: NousResearch#57137
NousResearch#57137