fix: explicit --api-key keeps OpenCode's per-model api_mode and base URL

The explicit-credential rung (hermes_cli/runtime_provider.py::_explicit_api_key_provider)
derived api_mode from the persisted config (opencode_by_model=False) and never ran
_finalize_base_url, so `hermes chat --provider opencode-go --api-key … -m qwen3.8-flash`
resolved to chat_completions + https://opencode.ai/zen/go/v1 and 404'd on the relay's SPA
page, while the same model through the env/config-key rung resolved to anthropic_messages +
https://opencode.ai/zen/go. OpenCode Zen/Go serve both wire formats behind one key, so the
route must follow the model on every credential rung, exactly as the env-key rung already
does (opencode_by_model=True + _finalize_base_url).

Ported from PR #100873 onto the post-refactor rung layout (the original hunk targeted
_resolve_explicit_runtime before 3ffd44acd3 split it into per-rung helpers).

Refs #100854

hermes_cli/runtime_provider.py

@@ -650,7 +650,8 @@ def _explicit_api_key_provider(provider, pconfig, requested_provider, model_cfg,
         if not base_url:
             base_url = _actual_url(provider, creds.get("base_url", "").rstrip("/"))
     api_mode = _api_key_provider_api_mode(provider, model_cfg, api_key, base_url, target_model or model_cfg.get("default", ""),
-                                          opencode_by_model=False)
+                                          opencode_by_model=True)
+    base_url = _finalize_base_url(provider, api_mode, base_url)
     api_key = _actual_local_key(provider, api_key, base_url)
     return _runtime(provider, api_mode, base_url.rstrip("/"), api_key, source="explicit", requested_provider=requested_provider)