Fixes #9283

Problem

hermes auth add openai-codex goes straight to the device code flow without checking for existing Codex CLI credentials at ~/.codex/auth.json. This blocks users whose org/workspace has device code auth disabled — they have valid tokens from codex login (browser OAuth) but no way to get them into Hermes.

The old hermes login --provider openai-codex had this import step in _login_openai_codex(), but it was never carried over to the new auth_add_command() in auth_commands.py.

Fix

• Check _import_codex_cli_tokens() before falling through to device code in auth_add_command()
• Prompt user to confirm import (default: yes)
• Fall through to device code if no CLI tokens found or user declines
• Add 3 tests covering: import path, no-tokens fallback, user-declines fallback
• Fix existing test_auth_add_codex_oauth_persists_pool_entry to isolate CODEX_HOME (pre-existing test leak on machines with real ~/.codex/auth.json)

Test Results

All 4 codex-related auth_commands tests pass:

tests/hermes_cli/test_auth_commands.py::test_auth_add_codex_oauth_persists_pool_entry PASSED
tests/hermes_cli/test_auth_commands.py::test_auth_add_codex_imports_from_cli_tokens PASSED
tests/hermes_cli/test_auth_commands.py::test_auth_add_codex_falls_through_to_device_code_when_no_cli_tokens PASSED
tests/hermes_cli/test_auth_commands.py::test_auth_add_codex_user_declines_import_falls_to_device_code PASSED

Note: 2 pre-existing auth_remove tests (test_auth_remove_accepts_label_target, test_auth_remove_prefers_exact_numeric_label_over_index) fail on machines with a real ~/.codex/auth.json due to missing CODEX_HOME isolation — this is a separate upstream issue not introduced by this change.