hermes - 💡(How to fix) Fix Bug: auth_mode: api_key sends x-api-key instead of Bearer for Azure Foundry Anthropic-style endpoints (v0.14.0)

## Summary

The official Azure Foundry guide (`website/docs/guides/azure-foundry.md`) states:

> "Bearer auth is used instead of `x-api-key`. Azure's Anthropic-compatible route requires `Authorization: Bearer <key>` rather than Anthropic's native `x-api-key` header. **Hermes detects `azure.com` in the base URL and routes the API key through the SDK's `auth_token` field** so the right header reaches the upstream."

However, on Hermes Agent **v0.14.0**, with `provider: azure-foundry`, `api_mode: anthropic_messages`, `auth_mode: api_key`, and a `base_url` containing `azure.com`, the request is sent with `x-api-key` instead of `Authorization: Bearer`. This results in HTTP 401 with error `"Access denied due to invalid subscription key or wrong API endpoint"`.

## Reproduction

1. Create profile with `model.provider: azure-foundry`, `model.api_mode: anthropic_messages`, `model.auth_mode: api_key`, `model.base_url: https://<resource>.services.ai.azure.com/anthropic`
2. Set `AZURE_FOUNDRY_API_KEY=<valid-key>` in `~/.hermes/.env`
3. Run `hermes chat` and send any prompt

Expected: Sonnet/Opus/Haiku responds normally.
Actual: HTTP 401 with `Auth method: x-api-key (API key)` shown in the error output.

## Error output (sanitized)

---

## Workaround validated

Switch to `auth_mode: entra_id` and use `az login` (or a managed identity in production). The DefaultAzureCredential chain mints a fresh Bearer JWT per request via the `azure_identity_adapter.build_bearer_http_client` hook, which works correctly.

---

## Suspected root cause

The `azure.com`-detection logic that should route the API key into the SDK's `auth_token` field appears not to fire for `auth_mode: api_key`. Either the detection branch is gated by `auth_mode: entra_id`, or the routing logic doesn't apply for `api_mode: anthropic_messages`.

## Impact

- Users following the official docs hit HTTP 401 immediately.
- Forces users to set up Entra ID even for simple POC/local use cases where API keys would be more convenient.
- The Azure Foundry endpoint silently rejects the wrong header — error message blames the key rather than the auth method, which is misleading.

## Environment

- Hermes Agent version: v0.14.0 (2026.5.16)
- OS: Ubuntu 22.04.5 LTS (Azure VM Standard_D2s_v3, France Central)
- Python: 3.11.15
- OpenAI SDK: 2.24.0
- Provider: azure-foundry
- Foundry account: AIServices kind, Sweden Central, deployment Sonnet 4.6