Summary

• clear model.api_key when switching to a saved custom provider that does not define an API key
• keep the existing api_mode behavior intact
• extend the named custom-provider regression test to cover stale auth cleanup

Problem

_model_flow_named_custom() already clears stale api_mode when the selected custom_providers entry does not specify one, but it leaves a stale model.api_key behind.

That means switching from an authenticated custom endpoint to a no-key local endpoint can preserve the old key in config.yaml, which is incorrect state and can affect subsequent requests.

Testing

• /Users/yiminglin/.hermes/hermes-agent/venv/bin/pytest -q tests/hermes_cli/test_custom_provider_model_switch.py
• manual temp-HERMES_HOME reproducer showing model.api_key is removed when selecting a no-key provider