feat: add managed tool gateway and Nous subscription support

- add managed modal and gateway-backed tool integrations\n- improve CLI setup, auth, and configuration for subscriber flows\n- expand tests and docs for managed tool support

tests/tools/test_managed_tool_gateway.py

@@ -0,0 +1,70 @@
+import os
+import json
+from datetime import datetime, timedelta, timezone
+from importlib.util import module_from_spec, spec_from_file_location
+from pathlib import Path
+import sys
+from unittest.mock import patch
+
+MODULE_PATH = Path(__file__).resolve().parents[2] / "tools" / "managed_tool_gateway.py"
+MODULE_SPEC = spec_from_file_location("managed_tool_gateway_test_module", MODULE_PATH)
+assert MODULE_SPEC and MODULE_SPEC.loader
+managed_tool_gateway = module_from_spec(MODULE_SPEC)
+sys.modules[MODULE_SPEC.name] = managed_tool_gateway
+MODULE_SPEC.loader.exec_module(managed_tool_gateway)
+resolve_managed_tool_gateway = managed_tool_gateway.resolve_managed_tool_gateway
+
+
+def test_resolve_managed_tool_gateway_derives_vendor_origin_from_shared_domain():
+    with patch.dict(os.environ, {"TOOL_GATEWAY_DOMAIN": "nousresearch.com"}, clear=False):
+        result = resolve_managed_tool_gateway(
+            "firecrawl",
+            token_reader=lambda: "nous-token",
+        )
+
+    assert result is not None
+    assert result.gateway_origin == "https://firecrawl-gateway.nousresearch.com"
+    assert result.nous_user_token == "nous-token"
+    assert result.managed_mode is True
+
+
+def test_resolve_managed_tool_gateway_uses_vendor_specific_override():
+    with patch.dict(os.environ, {"BROWSERBASE_GATEWAY_URL": "http://browserbase-gateway.localhost:3009/"}, clear=False):
+        result = resolve_managed_tool_gateway(
+            "browserbase",
+            token_reader=lambda: "nous-token",
+        )
+
+    assert result is not None
+    assert result.gateway_origin == "http://browserbase-gateway.localhost:3009"
+
+
+def test_resolve_managed_tool_gateway_is_inactive_without_nous_token():
+    with patch.dict(os.environ, {"TOOL_GATEWAY_DOMAIN": "nousresearch.com"}, clear=False):
+        result = resolve_managed_tool_gateway(
+            "firecrawl",
+            token_reader=lambda: None,
+        )
+
+    assert result is None
+
+
+def test_read_nous_access_token_refreshes_expiring_cached_token(tmp_path, monkeypatch):
+    monkeypatch.delenv("TOOL_GATEWAY_USER_TOKEN", raising=False)
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    expires_at = (datetime.now(timezone.utc) + timedelta(seconds=30)).isoformat()
+    (tmp_path / "auth.json").write_text(json.dumps({
+        "providers": {
+            "nous": {
+                "access_token": "stale-token",
+                "refresh_token": "refresh-token",
+                "expires_at": expires_at,
+            }
+        }
+    }))
+    monkeypatch.setattr(
+        "hermes_cli.auth.resolve_nous_access_token",
+        lambda refresh_skew_seconds=120: "fresh-token",
+    )
+
+    assert managed_tool_gateway.read_nous_access_token() == "fresh-token"