…ts + dedicated client_id

Adds China-region OAuth as a separate picker entry so users on the
minimaxi.com platform can sign in via browser without copying an
API key. Closes the gap where docs claimed `minimax-cn` supported
OAuth but the registered provider was api_key only (#25542).

Also migrates the MiniMax OAuth helpers from the OpenClaw-shared
`api.{minimax.io,minimaxi.com}/oauth/*` endpoints to the canonical
`account.{minimax.io,minimaxi.com}/oauth2/*` endpoints — same set
that mmx-cli and the opencode `minimax-coding-plan` plugin already
target. The `api/oauth/*` endpoints still work but are an older
surface; aligning on `account/oauth2/*` matches what MiniMax
platform team treats as canonical going forward.

Endpoint migration (verified live: both global + CN return HTTP 200
with valid user_code + verification_uri for the dedicated Hermes
client_id):

| | Before                                  | After |
|---|---|---|
| Global base | `https://api.minimax.io`              | `https://account.minimax.io` |
| CN base     | `https://api.minimaxi.com`             | `https://account.minimaxi.com` |
| Device code | `{base}/oauth/code`                     | `{base}/oauth2/device/code` |
| Token       | `{base}/oauth/token`                    | `{base}/oauth2/token` |
| Grant type  | `…:grant-type:user_code`               | `…:grant-type:device_code` (RFC 8628) |
| Scope       | `group_id profile model.completion`    | `openid profile coding_plan` |
| Extra param | `response_type: "code"` (sent in body) | (removed — new endpoint doesn't expect it) |

Approach for the new CN provider entry mirrors the existing
`_minimax_oauth_login(region="cn", ...)` code path that was already
in tree but never exposed. Storage and runtime resolution stay on
the existing `minimax-oauth` auth.json slot (region recorded inside
the entry) — no refactor of helper signatures, no new alias dispatch.

Each new branch follows the surrounding parallel-block style
(separate `if provider == "..."` blocks rather than collapsing with
the existing `minimax-oauth` branch) — keeps the diff easy to grep
and revert.

Changes
-------
- Plugin profile + ProviderConfig + Overlay + ProviderEntry for
  `minimax-cn-oauth`, mirroring `minimax-oauth` but with CN URLs.
- `auth_commands.py`: adds `minimax-cn-oauth` to the
  `_OAUTH_CAPABLE_PROVIDERS` set (so `hermes auth add` defaults to
  OAuth) and to the inline duplicate at line 173 (matching existing
  intent). New `if provider == "minimax-cn-oauth":` block routes
  to `_minimax_oauth_login(region="cn")`.
- `runtime_provider.py`: parallel `elif`/`if` blocks for the new
  provider in both `_resolve_provider_config` (api_mode pinning)
  and the runtime credential resolver.
- `models.py` adds the picker entry as the 4th MiniMax row.
- Docs: "China region" section in `minimax-oauth.md` rewritten to
  point at the new provider id.

Trade-off
---------
Switching between the global and China OAuth picker entries
triggers a fresh login (OAuth tokens live in the same auth.json
slot — last login wins, region is recorded inside). Users who need
both regions logged in concurrently would benefit from a follow-up
that splits storage by region; this PR keeps the change surface
minimal.

Client ID
---------
Switches from the previously shared OpenClaw client_id
(`78257093-...`) to a dedicated Hermes one
(`62a38dcb-17d9-4303-a71e-aa694efa20fd`) registered with MiniMax
specifically for this integration on the new OAuth2 backend.
Verified live: returns HTTP 200 with valid user_code from both
`account.minimax.io/oauth2/device/code` and
`account.minimaxi.com/oauth2/device/code`. Existing logged-in
users may need to re-authenticate once after upgrade since the
new client_id (and new endpoint) sees fresh OAuth grants.

Tests
-----
`tests/test_minimax_oauth.py` adds 1 test verifying the new
ProviderConfig is registered with the CN portal/inference URLs,
and updates one endpoint-path assertion. All 78 relevant tests
pass.