fix(doctor): honor a provider profile's models_url when base_url is empty

[HumphreySun98]

What does this PR do?

_build_apikey_providers_list computed the models-endpoint URL as:

_models_url = (
    (_pp.models_url or (_pp.base_url.rstrip("/") + "/models"))
    if _pp.base_url else None
)

The if _pp.base_url else None guard wraps the whole expression, so a
ProviderProfile that sets an explicit models_url but no base_url ends up
with default_url=None. But ProviderProfile.models_url is documented as the
explicit models endpoint, with base_url only supplying the
{base_url}/models fallback (providers/base.py:55). So a valid endpoint is
silently dropped: _probe_apikey_provider then calls httpx.get(None, ...)
and doctor always shows a spurious yellow "⚠ … couldn't verify" for that
provider, even with a valid key and a perfectly good models endpoint.

Fix

Honor models_url independently; the if base_url guard now wraps only the
fallback:

_models_url = (
    _pp.models_url
    or (_pp.base_url.rstrip("/") + "/models" if _pp.base_url else None)
)

Orthogonal to the open #9823 (which fixes double-appending /models in the
probe-time _build_models_url) — different function, different bug.

Related Issue

No existing issue — found via a code audit.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/doctor.py — honor models_url when base_url is empty.
• tests/hermes_cli/test_doctor_apikey_models_url.py — regression tests for the
  models_url-only and base_url-only cases.

How to Test

1. scripts/run_tests.sh tests/hermes_cli/test_doctor_apikey_models_url.py -q → all pass.
2. A profile with models_url set and base_url="" now yields that
   models_url as the doctor probe URL instead of None.

Checklist

• I've read the Contributing Guide
• Conventional Commits (fix(doctor):)
• I searched for existing PRs (orthogonal to fix: don't double-append /models when base_url already contains it #9823; none fix this)
• Only changes related to this fix
• Affected tests pass (3, incl. the adjacent dedicated-skip test). Full suite not run locally.
• Added regression tests
• Tested on: Ubuntu (WSL2), against current main

[teknium1]

Thanks for the focused fix and regression coverage. Current main still gates the explicit endpoint on base_url in hermes_cli/doctor.py:670-673, despite the provider contract resolving models_url independently in providers/base.py:202-207. The changed expression matches that contract and preserves the existing {base_url}/models fallback.

This is an automated hermes-sweeper review.