feat: implement Hermes config module and commands (Phase 3)

Add hermes_config.rs (~1190 lines) with YAML section-level replacement
that preserves comments and formatting in unmanaged sections:
- Type definitions: HermesModelConfig, HermesAgentConfig, HermesEnvConfig
- YAML section finder (find_yaml_section_range) with column-0 key detection
- Provider CRUD on custom_providers array (indexed by name field)
- Model/Agent config get/set via yaml<->json conversion
- .env dotenv read/write preserving comments and line ordering
- Health check, backup with rotation, write lock (OnceLock<Mutex>)
- MCP section access stubs for Phase 4
- 19 unit tests

Add commands/hermes.rs with 10 Tauri commands registered in lib.rs.
Replace all Hermes TODO stubs in services/provider/live.rs with real
implementations (import, remove, write-to-live, read-live-settings).

src-tauri/src/commands/hermes.rs

@@ -0,0 +1,94 @@
+use tauri::State;
+
+use crate::hermes_config;
+use crate::store::AppState;
+
+// ============================================================================
+// Hermes Provider Commands
+// ============================================================================
+
+/// Import providers from Hermes live config to database.
+///
+/// Hermes uses additive mode — users may already have providers
+/// configured in config.yaml.
+#[tauri::command]
+pub fn import_hermes_providers_from_live(state: State<'_, AppState>) -> Result<usize, String> {
+    crate::services::provider::import_hermes_providers_from_live(state.inner())
+        .map_err(|e| e.to_string())
+}
+
+/// Get provider names in the Hermes live config.
+#[tauri::command]
+pub fn get_hermes_live_provider_ids() -> Result<Vec<String>, String> {
+    hermes_config::get_providers()
+        .map(|providers| providers.keys().cloned().collect())
+        .map_err(|e| e.to_string())
+}
+
+/// Get a single Hermes provider fragment from live config.
+#[tauri::command]
+pub fn get_hermes_live_provider(
+    #[allow(non_snake_case)] providerId: String,
+) -> Result<Option<serde_json::Value>, String> {
+    hermes_config::get_provider(&providerId).map_err(|e| e.to_string())
+}
+
+/// Scan config.yaml for known configuration hazards.
+#[tauri::command]
+pub fn scan_hermes_config_health() -> Result<Vec<hermes_config::HermesHealthWarning>, String> {
+    hermes_config::scan_hermes_config_health().map_err(|e| e.to_string())
+}
+
+// ============================================================================
+// Model Configuration Commands
+// ============================================================================
+
+/// Get Hermes model config (model section of config.yaml)
+#[tauri::command]
+pub fn get_hermes_model_config() -> Result<Option<hermes_config::HermesModelConfig>, String> {
+    hermes_config::get_model_config().map_err(|e| e.to_string())
+}
+
+/// Set Hermes model config (model section of config.yaml)
+#[tauri::command]
+pub fn set_hermes_model_config(
+    model: hermes_config::HermesModelConfig,
+) -> Result<hermes_config::HermesWriteOutcome, String> {
+    hermes_config::set_model_config(&model).map_err(|e| e.to_string())
+}
+
+// ============================================================================
+// Agent Configuration Commands
+// ============================================================================
+
+/// Get Hermes agent config (agent section of config.yaml)
+#[tauri::command]
+pub fn get_hermes_agent_config() -> Result<Option<hermes_config::HermesAgentConfig>, String> {
+    hermes_config::get_agent_config().map_err(|e| e.to_string())
+}
+
+/// Set Hermes agent config (agent section of config.yaml)
+#[tauri::command]
+pub fn set_hermes_agent_config(
+    agent: hermes_config::HermesAgentConfig,
+) -> Result<hermes_config::HermesWriteOutcome, String> {
+    hermes_config::set_agent_config(&agent).map_err(|e| e.to_string())
+}
+
+// ============================================================================
+// Env Configuration Commands
+// ============================================================================
+
+/// Get Hermes env config (.env file)
+#[tauri::command]
+pub fn get_hermes_env() -> Result<hermes_config::HermesEnvConfig, String> {
+    hermes_config::read_env().map_err(|e| e.to_string())
+}
+
+/// Set Hermes env config (.env file)
+#[tauri::command]
+pub fn set_hermes_env(
+    env: hermes_config::HermesEnvConfig,
+) -> Result<hermes_config::HermesWriteOutcome, String> {
+    hermes_config::write_env(&env).map_err(|e| e.to_string())
+}

src-tauri/src/commands/mod.rs

@@ -10,6 +10,7 @@ mod deeplink;
 mod env;
 mod failover;
 mod global_proxy;
+mod hermes;
 mod import_export;
 mod mcp;
 mod misc;
@@ -42,6 +43,7 @@ pub use deeplink::*;
 pub use env::*;
 pub use failover::*;
 pub use global_proxy::*;
+pub use hermes::*;
 pub use import_export::*;
 pub use mcp::*;
 pub use misc::*;