fix(auth): resolve bare "openai" slug to "openai-api" provider

[rodboev]

Summary

resolve_provider("openai") raises AuthError: Unknown provider 'openai' even though openai-api is a registered provider and models.py already groups both slugs under the "openai" display key (line 993). Consumers that send the bare slug — WebUI model picker, config.yaml model.provider, CLI --provider flag — get a confusing error instead of routing to openai-api.

The alias tables in auth.py and models.py had entries for every other provider group ("claude": "anthropic", "google": "gemini", "grok": "xai") but not "openai". This surfaced during nesquena/hermes-webui#3444 where the WebUI picker collapsed openai-api to openai for display and the send path broke because the agent registry has no openai key.

Changes

• hermes_cli/auth.py: add "openai": "openai-api" to _PROVIDER_ALIASES in resolve_provider() (+1)
• hermes_cli/models.py: same entry in the models-layer _PROVIDER_ALIASES (+1)
• tests/hermes_cli/test_openai_provider_alias.py: new file, 7 tests covering resolve, case insensitivity, canonical passthrough, codex independence, registry presence, and the models.py alias (+39)

Validation

Scenario	Before	After
resolve_provider("openai")	AuthError: Unknown provider 'openai'	"openai-api"
resolve_provider("OpenAI")	same error	"openai-api" (case-insensitive)
resolve_provider("openai-api")	"openai-api"	"openai-api" (unchanged)
resolve_provider("openai-codex")	"openai-codex"	"openai-codex" (unchanged)

Test plan

• pytest tests/hermes_cli/test_openai_provider_alias.py -v — 7 passed
• pytest tests/hermes_cli/test_api_key_providers.py -v — 165 passed (regression check)
• Tested on Windows 11, Python 3.11. No platform-specific code.