fix(auth): qwen OAuth login reaches _mark_qwen_oauth_active in its moved owner

The compat sweep dropped the auth-facade re-export of _mark_qwen_oauth_active
while hermes_cli/auth_commands.py still reached it through the auth_mod module
alias, so every 'hermes auth add qwen' died with AttributeError on this branch.
Import it from hermes_cli/auth_qwen where it now lives. Module-alias attribute
reads dodge import-time checks; the sweep in the PR thread found this to be the
only production hit of that class.

Reported-by: yoniebans (PR #102117 review)

hermes_cli/auth_commands.py

@@ -187,8 +187,10 @@ def _anthropic_oauth_login(args) -> dict:
 
 
 def _qwen_oauth_login(args) -> dict:
+    from hermes_cli.auth_qwen import _mark_qwen_oauth_active
+
     creds = auth_mod.resolve_qwen_runtime_credentials(refresh_if_expiring=False)
-    auth_mod._mark_qwen_oauth_active(creds)
+    _mark_qwen_oauth_active(creds)
     return creds
 
 

tests/hermes_cli/test_auth_commands.py

@@ -1110,3 +1110,20 @@ def test_auth_remove_env_seeded_dotenv_with_bom_no_shell_hint(tmp_path, monkeypa
     out = capsys.readouterr().out
     assert "Cleared DEEPSEEK_API_KEY from .env" in out
     assert "still set in your shell environment" not in out
+
+
+def test_qwen_oauth_login_marks_active_through_moved_owner(monkeypatch):
+    """`_mark_qwen_oauth_active` lives in `auth_qwen`; the login flow must reach it
+    without depending on a re-export from the `auth` facade (AttributeError on head before)."""
+    import hermes_cli.auth_commands as auth_commands
+    import hermes_cli.auth_qwen as auth_qwen
+
+    creds = {"access_token": "tok"}
+    marked = []
+    monkeypatch.setattr(
+        auth_commands.auth_mod, "resolve_qwen_runtime_credentials", lambda **kw: creds
+    )
+    monkeypatch.setattr(auth_qwen, "_mark_qwen_oauth_active", lambda c: marked.append(c))
+
+    assert auth_commands._qwen_oauth_login(None) is creds
+    assert marked == [creds]