Summary

• Add --manual-code / --paste-code for xAI Grok OAuth so remote, phone, Discord, SSH, and headless sessions can complete login without a live loopback callback.
• Let users open the xAI authorize URL on any device, paste the failed localhost redirect URL or one-time code back into Hermes, then complete the normal PKCE token exchange.
• Preserve OAuth protections by reusing the same PKCE verifier and redirect URI, validating state when a full redirect URL/query string is pasted, and sharing token exchange validation with the loopback flow.
• Wire the flag through hermes login, hermes auth add, and hermes model.
• Update xAI OAuth and OAuth-over-SSH docs to recommend manual-code mode for phone/remote flows while keeping SSH tunnels as the automatic callback alternative.

Why

The existing xAI OAuth flow starts a localhost callback listener on the Hermes machine. That works when the browser is also on that machine, but it breaks when Hermes is being driven from Discord, a phone, SSH, WSL, or another remote setup. In those cases, xAI redirects the browser to 127.0.0.1 on the browser device, not the machine running Hermes.

Manual-code mode keeps the existing xAI PKCE flow, but gives the user a way to paste the authorization response back into Hermes when the browser cannot reach the local listener.

Test plan

• python -m py_compile hermes_cli/auth.py hermes_cli/auth_commands.py hermes_cli/main.py
• python -m pytest tests/hermes_cli/test_auth_xai_oauth_provider.py tests/hermes_cli/test_auth_commands.py tests/hermes_cli/test_auth_loopback_ssh_hint.py tests/hermes_cli/test_argparse_flag_propagation.py -o 'addopts=' -q
• python -m pytest tests/hermes_cli/test_auth*.py tests/hermes_cli/test_argparse_flag_propagation.py -o 'addopts=' -q
• git diff --check