Bug Description

hermes doctor reports Google Gemini API (invalid API key) — a false positive. The GOOGLE_API_KEY is valid and functional; only the healthcheck probe is broken.

Root Cause

The healthcheck probe for the gemini provider sends the API key as a Bearer token:

Authorization: Bearer <GOOGLE_API_KEY>

However, the Google Generative Language API /v1beta/models endpoint does not support Bearer token authentication — it only accepts the key as a ?key= query parameter.

Verified:

Bearer header  → HTTP 401 Unauthorized
?key= query    → HTTP 200 OK

Reproduction

1. Have a valid GOOGLE_API_KEY in ~/.hermes/.env
2. Run hermes doctor
3. Observe: ✗ gemini (invalid API key)

Expected Behavior

The healthcheck should either:

• Use ?key=<GOOGLE_API_KEY> query parameter for Google endpoints, OR
• Skip the healthcheck for providers that don't support Bearer token auth (similar to how MiniMax China is handled with supports_health_check=False)

Context

• Provider: gemini (Google Generative Language API)
• Endpoint hit: https://generativelanguage.googleapis.com/v1beta/models
• The key works perfectly for actual Gemini API calls — only the healthcheck fails
• Related code: hermes_cli/doctor.py _build_apikey_providers_list() which dynamically pulls in the gemini plugin

Suggested Fix

In _build_apikey_providers_list() or the healthcheck loop, either:

1. Special-case the gemini provider to use ?key= query param, OR
2. Add supports_health_check=False to the gemini profile (like MiniMax China)