Mirrors the canvas-tools pattern (#56) for the just-shipped
devagentic-docs plugin (#12 / PRs #19+#20+#23). MCP-aware clients
(Claude Code, Cursor, Codex) can now writeDoc / searchDocs /
forkContext / decorateContext / renderContext against any
devagentic instance hermes is configured for.

New tools (7):
- doc_search(query, limit, tag)  → search_docs
- doc_write(content, tags, source) → write_doc
- doc_show(doc_id)               → get_doc
- fork_open(parent_id, goal, tags) → fork_context (auto-pins
                                     parent + threads goal)
- fork_decorate(ctx_id, key, value, weight) → decorate_context
- fork_get(ctx_id)               → get_context
- fork_render(ctx_id)            → render_context (envelope:
                                   {ctx_id, rendered})

Loader pattern: _resolve_docs_client() mirrors
_resolve_canvas_client at line 880 — file-path import of
plugins/devagentic-docs/client.py since the hyphenated dir
isn't a Python package.

Failure semantics: every tool returns {"error": "<msg>"} JSON.
The plugin's last_error_text() pattern (introduced in #15)
threads through via a _reason() helper, so federated agents
see the same actionable hints CLI users get — e.g. on the
canonical devbox deployment (where /graphql isn't exposed,
see #21), they'd see "not found at <url>/graphql ..." instead
of an opaque None.

Out of scope per #24: fork_close + fork_pin depend on the
session-local $HERMES_HOME/docs-fork-active marker, which
doesn't translate to MCP's stateless tool model. fork_open
auto-tags with source:hermes-mcp so MCP-authored forks are
distinguishable from CLI-authored ones (source:hermes-cli).

Tests: 22 new (tests/test_mcp_docs.py) covering registration,
plugin-missing fallback, arg routing, last_error surfacing for
the #21 case, and the real-import smoke. All passing alongside
canvas MCP suite (14 existing) and the broader devagentic-
adjacent test set (159 total).

Closes #24.

…#39)

The same urllib HTTPError + URLError + OSError + TimeoutError
dispatch repeats in three sites after #15/#18/#20:

  plugins/devagentic-canvas/client.py:_request
  plugins/devagentic-docs/client.py:_post_graphql
  hermes_cli/doctor.py:_check_devagentic_graph

Each site has the same if-401/403-elif-404-else branches over the
exception and the same urllib network-error fallback. Only the
message text differs per site.

Add `utils.classify_http_error(exc) -> str` returning one of:
  HTTP_ERROR_AUTH        — 401 / 403
  HTTP_ERROR_NOT_FOUND   — 404
  HTTP_ERROR_HTTP        — other HTTPError status
  HTTP_ERROR_UNREACHABLE — URLError / OSError / TimeoutError
  HTTP_ERROR_UNKNOWN     — anything else

Refactor the three callsites onto a single `except (URLError, OSError,
TimeoutError)` (HTTPError is a URLError subclass) followed by a
dispatch on the classifier output. Each site still owns its own
message text — the user-facing strings are unchanged.

Behavior change: none. Net diff is roughly even (helper + dispatch
replaces three near-identical if/elif/else blocks).

Tests:
  - 11 new tests in tests/test_utils_classify_http_error.py covering
    401, 403, 404, generic statuses (400/422/429/500/502/503/504),
    URLError, OSError, TimeoutError, socket.timeout, unrelated
    exceptions, and the HTTPError-is-URLError subclass quirk.
  - All three refactored callsites' existing test suites still pass:
    canvas (47), docs (47), doctor devagentic-graph (6) — 112 total.

Closes #38.