fix dashboard auth rows for new harnesses

[Svector-anu]

What

Make the Cursor, Hermes, and GLM credentials permanent first-class rows in Settings → Access Keys, and give Hermes the same Connect/Reconnect behavior as the existing captured-login harnesses.

Why

PR #967 added all three harnesses to installation, resolution, execution, and the top-bar picker, but their credentials were not added to the dashboard builtin catalog. A secret appeared only after it had already been set, as a generic custom Skill Keys row; an unset credential disappeared entirely. HERMES_AUTH also was not mapped to its native OAuth flow, so its set row offered Remove but no Reconnect.

Fix

• add CURSOR_API_KEY, HERMES_AUTH, and GLM_API_KEY as permanent Core credentials with setup context
• derive OAuth-secret → harness mappings from the central harness registry, covering Hermes and preventing future parallel-list drift
• add Cursor, Nous, and Z.AI service marks
• add accurate modal titles/copy and only mention OpenRouter fallback for harnesses that actually support it
• add focused regression coverage for permanent visibility and captured-login routing

Verification

• dashboard tests: 198 passed
• dashboard typecheck: passed
• dashboard production build: passed (one existing Turbopack trace warning)
• dashboard lint: 0 errors, 14 existing warnings
• live metadata smoke against Svector-anu/svectors-lab: all three returned group=Core and isSet=true; no secret values were read
• git diff --check: clean

Mutation checks:

1. Removed only the three builtin catalog rows while keeping the test: keeps every new harness credential visible even before it is set failed with actual undefined, expected Core.
2. Excluded only Hermes from the derived OAuth mapping while keeping the test: maps every captured login secret to its Connect/Reconnect flow failed because HERMES_AUTH was absent.
3. Restored both fixes: focused 12/12 green and full dashboard suite 198/198 green.

[aaronjmars]

Merging this - correct, tested, and green. One follow-up nit (not a blocker, predates this PR): the fx harness (added in #941; AI_GATEWAY_API_KEY) has the exact same catalog gap this PR fixes for cursor/hermes/glm - it only shows as a generic Custom-secret row once set, and is invisible when unset. Worth a one-line AI_GATEWAY_API_KEY Core row in secrets-catalog.ts, plus a registry-derived parity test (iterate HARNESS_AUTH native-key secrets against BUILTIN_NAMES) so the next harness can't silently drift out again. Also the OPENROUTER_API_KEY description in secrets-catalog.ts:19 now undercounts - hermes falls back to OpenRouter too, so it's five harnesses, not four. Follow-up PR is fine.