fix(auth): use refresh-free Nous status snapshot on read-only display paths

Follow-up widening of the /api/status fix: add get_nous_auth_status_local(),
a refresh-free auth-store snapshot (local invoke-JWT decode only), and use it
on the read-only display surfaces that previously called
get_nous_auth_status() -> resolve_nous_runtime_credentials() -> live OAuth
refresh POST:

- hermes_cli/status.py  (hermes status auth-provider panel)
- hermes_cli/doctor.py  (hermes doctor auth-provider checks)
- hermes_cli/portal_cli.py  (hermes portal status display)
- hermes_cli/web_server.py  /api/portal endpoint and the accounts-tab
  provider card dispatcher (_resolve_provider_status nous branch)

Action paths (login flows, portal operations needing a live credential)
keep using get_nous_auth_status(). Part of NS-592.

hermes_cli/web_server.py

@@ -3696,9 +3696,11 @@ async def get_portal_status():
     cfg = load_config() or {}
     auth: Dict[str, Any] = {}
     try:
-        from hermes_cli.auth import get_nous_auth_status
+        from hermes_cli.auth import get_nous_auth_status_local
 
-        auth = get_nous_auth_status() or {}
+        # Read-only dashboard endpoint: refresh-free snapshot so polling
+        # never performs an OAuth refresh or burns a refresh token.
+        auth = get_nous_auth_status_local() or {}
     except Exception:
         auth = {}
 
@@ -10331,7 +10333,9 @@ def _resolve_provider_status(provider_id: str, status_fn) -> Dict[str, Any]:
     try:
         from hermes_cli import auth as hauth
         if provider_id == "nous":
-            raw = hauth.get_nous_auth_status()
+            # Read-only accounts-tab card: refresh-free snapshot so listing
+            # providers never performs an OAuth refresh.
+            raw = hauth.get_nous_auth_status_local()
             return {
                 "logged_in": bool(raw.get("logged_in")),
                 "source": "nous_portal",