docs(bot-mode): name the real create control, scope the isolation claim

The credential bullet claimed a Bot "never shares an OAuth/token pool with the
main profile, so each profile refreshes only its own credentials", and cited
legacy create fields `share_auth` and `shared_auth`.

Both are wrong against the code:

- Nous Portal deliberately shares state across profiles
  (`hermes_cli/auth_nous.py:_nous_shared_auth_dir` keeps
  `<root>/shared/nous_auth.json` outside every named profile, and a named
  profile merges it), and the nous OAuth row is not in
  `SINGLE_USE_REFRESH_POOL_PROVIDERS`, so credential mirroring copies it into
  the new Bot. The absolute sentence was true only for the three single-use
  providers.
- `shared_auth` is not a create field anywhere in the tree or in git history;
  only `share_auth` exists, accepted and ignored
  (`tui_gateway/methods_profiles.py`). A user cannot act on either name, so the
  user-guide bullet no longer lists them.

The bullet now names the control the reader actually sees ("Copy API keys from
the main profile", on by default per the New Agent dialog), states what copying
does (static keys in, single-use OAuth logins not), gives the recovery step the
report asked for, and links the canonical rules in profiles.md instead of
restating them loosely. zh-Hans mirror updated in lockstep.

website/docs/user-guide/bot-mode.md

@@ -54,7 +54,7 @@ An **Advanced** disclosure opens the full capabilities surface:
 - **Model & provider pin** — give the Bot its own model. Any provider/model pair Hermes knows about works, and different Bots can run on different models side by side. Leave it unset to inherit from the launch profile.
 - **Custom SOUL.md** — the Bot's persona and standing instructions.
 - **Per-skill, per-toolset, and per-MCP-server enablement** — tick exactly the capabilities this specialist needs.
-- **Credentials** — every new Bot owns an isolated credential store; it never shares an OAuth/token pool with the main profile, so each profile refreshes only its own credentials. If credential mirroring is enabled, Hermes copies supported credentials into the new profile rather than sharing them. Legacy `share_auth` and `shared_auth` create fields are ignored.
+- **Copy API keys from the main profile** — on by default. Each Bot gets its own credential store: static API keys are copied in, while single-use OAuth logins (Anthropic, OpenAI Codex, xAI) are not copied — sign the Bot in itself with `hermes -p <name> auth add <provider>`. See [Every profile owns its credentials](./profiles.md#every-profile-owns-its-credentials).
 
 ### Choosing which machine it lives on ("Create on")
 

website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/bot-mode.md

@@ -50,7 +50,7 @@ Bot 模式**内置于[桌面应用](./desktop)**中，**默认开启**——无
 - **模型与 provider 锁定**——为 Bot 指定专属模型。Hermes 支持的任意 provider/model 组合都可以使用，不同的 Bot 可以并排运行在不同的模型上。留空则继承自启动 profile。
 - **自定义 SOUL.md**——Bot 的人格与常驻指令。
 - **按技能、按工具集、按 MCP 服务器逐项启用**——精确勾选这个专精 Bot 需要的能力。
-- **凭据**——每个新 Bot 都拥有隔离的凭据存储；它绝不会与主 profile 共用 OAuth/token 池，因此每个 profile 只刷新自己的凭据。启用凭据镜像时，Hermes 会把受支持的凭据复制到新 profile，而不是共享它们。旧版的 `share_auth` 和 `shared_auth` 创建字段会被忽略。
+- **从主 profile 复制 API 密钥**——默认开启。每个 Bot 都拥有自己的凭据存储：静态 API 密钥会被复制进来，而一次性 OAuth 登录（Anthropic、OpenAI Codex、xAI）不会被复制——请用 `hermes -p <name> auth add <provider>` 在 Bot 内登录。详见[每个 profile 各自拥有凭据](./profiles.md)。
 
 ### 选择它运行在哪台机器上（"Create on"）