Send live session completion and agent display names

[Pavel-Tk]

Summary

• send capture_session on real Hermes session boundaries (on_session_reset, on_session_finalize) so the server materializes live sessions into the extraction pipeline (the stop-word recall gap)
• idempotent per session; every failure is swallowed so boundaries never block the host
• pass an agent display name with the device grant (SUBSTRATE_AGENT_NAME / HERMES_PROFILE); the approval page can override it and the agent pane shows and renames it
• plugin.yaml declares the two new hooks; setup.py gains --name

Server counterpart (already live on vm-substrate-ar-01)

• agent-auth.mjs: grant display_name, approve override, name echoed at issuance
• hermes-setup.mjs: hermes_api_keys.display_name + updateAgentName + listAuthorizedAgents name
• tenant-runtime.mjs: registerAgentCredential displayName; PATCH name route
• frontend: approval-page name input; agent pane shows/renames name

Validation

• 92 plugin tests, Ruff clean
• server: 85/85 node tests (agent-auth, hermes-setup incl. live materialization, server routes)
• frontend: 25/25 vitest
• live: grant with agent_name=Henry Hermes persisted and echoed; approved-grant exchange issued credential with display_name Henry Bot visible in hermes_api_keys and listAuthorizedAgents (test rows cleaned up)