feat: dashboard OAuth management, session pagination & analytics cleanup

[kshitijk4poor]

Summary

Adds OAuth provider management and session pagination to the Hermes dashboard, and cleans up the analytics page by removing unreliable cost/cache UI.

Dashboard — OAuth Provider Management

Backend (hermes_cli/web_server.py):

• 6 new API endpoints for full OAuth lifecycle:
  • GET /api/providers/oauth — list all providers with connection status
  • POST /api/providers/oauth/{id}/start — initiate PKCE or device-code flow
  • POST /api/providers/oauth/{id}/submit — exchange PKCE authorization code
  • GET /api/providers/oauth/{id}/poll/{session} — poll device-code approval
  • DELETE /api/providers/oauth/{id} — disconnect provider
  • DELETE /api/providers/oauth/sessions/{session_id} — cancel pending session
• Supports Anthropic (PKCE), Nous and OpenAI Codex (device-code)
• OAuth constants imported from anthropic_adapter (no duplication)
• Blocking I/O wrapped in run_in_executor for async safety
• In-memory session store with 15-minute TTL and automatic GC
• Auth token required on all mutating endpoints

Frontend:

• OAuthLoginModal — handles both PKCE (paste auth code) and device-code (poll for approval) flows
• OAuthProvidersCard — connection status, token preview, connect/disconnect actions
• Integrated into the Env/Keys page

Dashboard — Session Pagination

• GET /api/sessions now accepts limit and offset query params (was hardcoded to 20)
• Returns {sessions, total, limit, offset} instead of a bare array
• Frontend shows 20 sessions per page with prev/next controls and "1–20 of N" label
• Total session count displayed in header badge
• StatusPage updated to handle new response shape

Dashboard — Analytics Cleanup

• Removed cost columns and cache hit UI from the analytics page (unreliable without a pricing backend)
• Removed: formatCost(), bestCost(), Cache Hit summary card, Total Cost summary card, Cost/Cache columns in daily and model tables
• Simplified to 3 summary cards: Total Tokens, Total Sessions, API Calls

Frontend Fixes

• Toast.tsx — render via createPortal to document.body for correct z-index
• App.tsx — skip animation key bump on initial mount to prevent double-mount / duplicate API calls
• main.tsx — remove StrictMode wrapper

Test Plan

• pytest tests/hermes_cli/test_web_server.py — 47 passed
• Manual API test: all 6 OAuth endpoints verified via curl
• Playwright smoke test: OAuth card renders, PKCE flow starts, analytics has zero cost/cache
• Frontend builds clean (npm run build)
• Full test suite

[kshitijk4poor]

Superseded by new PR with UX polish included.