fix(hermes): prevent YAML pollution and drop of OAuth mcp auth

DeepLink Hermes import was emitting camelCase (baseUrl / apiKey /
apiMode) that the Hermes runtime does not recognise, poisoning
`custom_providers:` entries on activation. The MCP sync path was
also stripping `auth: oauth` on round-trip, silently downgrading
OAuth-type servers to unauthenticated calls.

The Hermes deeplink branch now emits snake_case via a dedicated
builder; `sanitize_hermes_provider_keys` runs on both `set_provider`
and `get_providers` so legacy DB records heal on next access.
`HERMES_EXTRA_FIELDS` preserves `auth`. The `api_mode` dropdown gains
`codex_responses` (Copilot / OpenCode), and the schema-migrated
warning copy no longer hard-codes "v12" (upstream `_config_version`
is now 19).

src/config/hermesProviderPresets.ts

@@ -45,7 +45,10 @@ export interface HermesSuggestedDefaults {
 }
 
 /** Hermes custom_provider protocol mode (optional; auto-detected when omitted). */
-export type HermesApiMode = "chat_completions" | "anthropic_messages";
+export type HermesApiMode =
+  | "chat_completions"
+  | "anthropic_messages"
+  | "codex_responses";
 
 /**
  * Form-facing value used by the API Mode dropdown.
@@ -70,6 +73,7 @@ export const hermesApiModes: Array<{
     value: "anthropic_messages",
     labelKey: "hermes.form.apiModeAnthropicMessages",
   },
+  { value: "codex_responses", labelKey: "hermes.form.apiModeCodexResponses" },
 ];
 
 export interface HermesProviderPreset {