docs: add 11 new pages + expand 4 existing pages (26 → 37 total)

New pages (sourced from actual codebase):
- Security: command approval, DM pairing, container isolation, production checklist
- Session Management: resume, export, prune, search, per-platform tracking
- Context Files: AGENTS.md project context, discovery, size limits, security
- Personality: SOUL.md, 14 built-in personalities, custom definitions
- Browser Automation: Browserbase setup, 10 browser tools, stealth mode
- Image Generation: FLUX 2 Pro via FAL, aspect ratios, auto-upscaling
- Provider Routing: OpenRouter sort/only/ignore/order config
- Honcho: AI-native memory integration, setup, peer config
- Home Assistant: HASS setup, 4 HA tools, WebSocket gateway
- Batch Processing: trajectory generation, dataset format, checkpointing
- RL Training: Atropos/Tinker integration, environments, workflow

Expanded pages:
- code-execution: 51 → 195 lines (examples, limits, security, comparison table)
- delegation: 60 → 216 lines (context tips, batch mode, model override)
- cron: 88 → 273 lines (real-world examples, delivery options, expression cheat sheet)
- memory: 98 → 249 lines (best practices, capacity management, examples)

website/docs/user-guide/features/provider-routing.md

@@ -0,0 +1,196 @@
+---
+title: Provider Routing
+description: Configure OpenRouter provider preferences to optimize for cost, speed, or quality.
+sidebar_label: Provider Routing
+sidebar_position: 7
+---
+
+# Provider Routing
+
+When using [OpenRouter](https://openrouter.ai) as your LLM provider, Hermes Agent supports **provider routing** — fine-grained control over which underlying AI providers handle your requests and how they're prioritized.
+
+OpenRouter routes requests to many providers (e.g., Anthropic, Google, AWS Bedrock, Together AI). Provider routing lets you optimize for cost, speed, quality, or enforce specific provider requirements.
+
+## Configuration
+
+Add a `provider_routing` section to your `~/.hermes/config.yaml`:
+
+```yaml
+provider_routing:
+  sort: "price"           # How to rank providers
+  only: []                # Whitelist: only use these providers
+  ignore: []              # Blacklist: never use these providers
+  order: []               # Explicit provider priority order
+  require_parameters: false  # Only use providers that support all parameters
+  data_collection: null   # Control data collection ("allow" or "deny")
+```
+
+:::info
+Provider routing only applies when using OpenRouter. It has no effect with direct provider connections (e.g., connecting directly to the Anthropic API).
+:::
+
+## Options
+
+### `sort`
+
+Controls how OpenRouter ranks available providers for your request.
+
+| Value | Description |
+|-------|-------------|
+| `"price"` | Cheapest provider first |
+| `"throughput"` | Fastest tokens-per-second first |
+| `"latency"` | Lowest time-to-first-token first |
+
+```yaml
+provider_routing:
+  sort: "price"
+```
+
+### `only`
+
+Whitelist of provider names. When set, **only** these providers will be used. All others are excluded.
+
+```yaml
+provider_routing:
+  only:
+    - "Anthropic"
+    - "Google"
+```
+
+### `ignore`
+
+Blacklist of provider names. These providers will **never** be used, even if they offer the cheapest or fastest option.
+
+```yaml
+provider_routing:
+  ignore:
+    - "Together"
+    - "DeepInfra"
+```
+
+### `order`
+
+Explicit priority order. Providers listed first are preferred. Unlisted providers are used as fallbacks.
+
+```yaml
+provider_routing:
+  order:
+    - "Anthropic"
+    - "Google"
+    - "AWS Bedrock"
+```
+
+### `require_parameters`
+
+When `true`, OpenRouter will only route to providers that support **all** parameters in your request (like `temperature`, `top_p`, `tools`, etc.). This avoids silent parameter drops.
+
+```yaml
+provider_routing:
+  require_parameters: true
+```
+
+### `data_collection`
+
+Controls whether providers can use your prompts for training. Options are `"allow"` or `"deny"`.
+
+```yaml
+provider_routing:
+  data_collection: "deny"
+```
+
+## Practical Examples
+
+### Optimize for Cost
+
+Route to the cheapest available provider. Good for high-volume usage and development:
+
+```yaml
+provider_routing:
+  sort: "price"
+```
+
+### Optimize for Speed
+
+Prioritize low-latency providers for interactive use:
+
+```yaml
+provider_routing:
+  sort: "latency"
+```
+
+### Optimize for Throughput
+
+Best for long-form generation where tokens-per-second matters:
+
+```yaml
+provider_routing:
+  sort: "throughput"
+```
+
+### Lock to Specific Providers
+
+Ensure all requests go through a specific provider for consistency:
+
+```yaml
+provider_routing:
+  only:
+    - "Anthropic"
+```
+
+### Avoid Specific Providers
+
+Exclude providers you don't want to use (e.g., for data privacy):
+
+```yaml
+provider_routing:
+  ignore:
+    - "Together"
+    - "Lepton"
+  data_collection: "deny"
+```
+
+### Preferred Order with Fallbacks
+
+Try your preferred providers first, fall back to others if unavailable:
+
+```yaml
+provider_routing:
+  order:
+    - "Anthropic"
+    - "Google"
+  require_parameters: true
+```
+
+## How It Works
+
+Provider routing preferences are passed to the OpenRouter API via the `extra_body.provider` field on every API call. This applies to both:
+
+- **CLI mode** — configured in `~/.hermes/config.yaml`, loaded at startup
+- **Gateway mode** — same config file, loaded when the gateway starts
+
+The routing config is read from `config.yaml` and passed as parameters when creating the `AIAgent`:
+
+```
+providers_allowed  ← from provider_routing.only
+providers_ignored  ← from provider_routing.ignore
+providers_order    ← from provider_routing.order
+provider_sort      ← from provider_routing.sort
+provider_require_parameters ← from provider_routing.require_parameters
+provider_data_collection    ← from provider_routing.data_collection
+```
+
+:::tip
+You can combine multiple options. For example, sort by price but exclude certain providers and require parameter support:
+
+```yaml
+provider_routing:
+  sort: "price"
+  ignore: ["Together"]
+  require_parameters: true
+  data_collection: "deny"
+```
+:::
+
+## Default Behavior
+
+When no `provider_routing` section is configured (the default), OpenRouter uses its own default routing logic, which generally balances cost and availability automatically.