feat(proxy): local OpenAI-compatible proxy for OAuth providers (#25969)

Adds 'hermes proxy start' — a local HTTP server that lets external apps
(OpenViking, Karakeep, Open WebUI, ...) use a Hermes-managed provider
subscription as their LLM endpoint. The proxy attaches the user's real
OAuth-resolved credentials to each forwarded request, refreshing them
automatically; the client can send any bearer (it gets stripped).

Ships with one adapter — Nous Portal. The UpstreamAdapter ABC and
registry in hermes_cli/proxy/adapters/ are designed for additional
OAuth providers to plug in by name without server changes.

Commands:
  hermes proxy start [--provider nous] [--host 127.0.0.1] [--port 8645]
  hermes proxy status
  hermes proxy providers

Allowed Portal paths: /v1/chat/completions, /v1/completions,
/v1/embeddings, /v1/models. Anything else returns 404 with a clear
error pointing at the allowed list.

aiohttp is gated like gateway/platforms/api_server.py (try-import,
clean runtime error if missing). No new core dependency.

Tests: 24 unit tests + 1 separate E2E that spawns the real subprocess
and verifies the upstream receives the right bearer with the client's
header stripped.

hermes_cli/proxy/__init__.py

@@ -0,0 +1,20 @@
+"""Local OpenAI-compatible proxy that forwards to OAuth-authenticated upstreams.
+
+Lets external apps (OpenViking, Karakeep, Open WebUI, ...) ride the user's
+already-logged-in provider subscription instead of needing a static API key
+copy-pasted into each app's config.
+
+The proxy listens on ``127.0.0.1:<port>``, accepts any bearer (the client's
+``Authorization`` header is discarded), and attaches the user's real
+upstream credential to the forwarded request. The credential is refreshed
+automatically when it approaches expiry.
+
+First-class adapter:
+  - ``nous`` — Nous Portal (https://inference-api.nousresearch.com/v1)
+
+Future adapters can plug in by implementing ``UpstreamAdapter``.
+"""
+
+from hermes_cli.proxy.adapters.base import UpstreamAdapter
+
+__all__ = ["UpstreamAdapter"]