fix(settings): wire provider OAuth, add canonical hermes-config API

[Dak0verflow]

Summary

• Adds /api/hermes-config with explicit patch actions: set-default-model, set-api-key, remove-api-key, set-custom-provider, remove-custom-provider. Backed by src/server/hermes-config-store.ts (path resolution, env IO, action handlers) and src/server/hermes-config-migration.ts (config-shape normalizer).
• /api/claude-config becomes a thin alias on the same handlers in src/server/hermes-config-route.ts. provider.maskedKeys is aliased from the new provider.maskedCredentials so the existing /settings page keeps rendering.
• /api/oauth/device-code and /api/oauth/poll-token delegate to dashboardFetch('/api/providers/oauth/{provider}/...') instead of the hardcoded Nous-portal path. Any provider the dashboard registers now works through the WebUI device-code flow.
• Settings dialog: provider card clicks open a detail panel and no longer save. Default model commits via an explicit Set as default: {provider} · {model} button that renders only when the previewed selection differs from the saved default. Adds the OAuth device-code detail panel, the local-provider detail (detection status + discovered models), and a Model row to the Custom endpoint section.
• /api/connection-status passes through capabilities.mcpFallback.
• Save responses are now action-specific (Default model updated., API key saved., etc.). Drops the blanket Restart Claude/Hermes to apply changes. copy.

Test plan

pnpm exec vitest run src/server/hermes-config-*.test.ts src/routes/api/-hermes-config.test.ts src/routes/api/-oauth.test.ts src/routes/api/-connection-status.test.ts src/components/settings-dialog/settings-dialog.test.tsx

Manual:

• Nous Portal and OpenAI Codex: card → Start OAuth → authorize → success message.
• OpenRouter (key set): card → pick auto → click Set as default: openrouter · auto → next chat uses it.
• Custom: enter Base URL + Model → Set as default → close/reopen dialog, both persist.

[outsourc-e]

Closing as superseded by #432. The validated fix was folded into the consolidated batch branch fix/issue-sweep-batch-20260514 for one review/merge path.