TODO

• Default model: the gateway serves /v1 without a configured model.default; agent turns need hermes config set model.default ollama/<alias> against the LiteLLM-backed provider. Bake it via a config template once a turn-level e2e assertion exists.

• SSO: the API server authenticates with API_SERVER_KEY only; services.sso is dropped because an oauth2 proxy in front of the bearer API breaks OpenAI-compatible clients. Revisit if a browser dashboard surface appears upstream.