Two invariants per fix: the oauth plugin owns every hermes auth action through the real argparse
surface (and a handler-less oauth profile fails loud while openrouter never consults the seam);
the registry is complete after a mid-discovery auth import (subprocess) and a post-discovery
register_provider() is mirrored; plugin pool rows refresh through refresh_credential (hook-less
rows are returned unchanged) and unknown extra keys survive from_dict -> to_dict -> from_dict.
370ac6b4c1