[Feature]: Support fixed test OTP codes in hermes vault add #137094

Feature request

Add an explicit fixed-OTP option when creating a login with hermes vault add --kind login, for local development and testing.

Today, login items accept an authenticator seed or otpauth:// TOTP URI. For test accounts and deterministic browser-flow tests, it would be useful to choose a fixed OTP value instead, such as 258000, without changing the existing TOTP behavior.

Proposed behavior

• Keep TOTP as the default and preserve the current authenticator-key workflow.
• Offer an explicit fixed OTP (test only) option during login creation.
• Validate fixed values as exactly six decimal digits.
• Store the value only in the encrypted secret payload; never expose it in metadata, vault list, logs, or diagnostics.
• Have the local vault OTP resolver return that fixed value for the selected item; continue generating time-based codes for normal TOTP seeds.
• Clearly warn that this option is for testing only and must not be used for production accounts.

Acceptance criteria

• A login can be created with a fixed test OTP without supplying a TOTP seed.
• Invalid fixed values are rejected before saving the vault item.
• The fixed value remains encrypted and unavailable through metadata/listing.
• Existing TOTP behavior and tests remain unchanged.
• Tests cover validation, resolution, secrecy, and the TOTP regression path.

This should complement the existing vault flow, not add a general OTP abstraction or production authentication mechanism.