fix: persist Slack signing secret and sync models.json in web mode

Two critical correctness bugs from recent commits:

1. Hermes Slack signingSecret was stripped from config.yaml on save but
   never written to SLACK_SIGNING_SECRET in ~/.hermes/.env, causing data
   loss and broken HTTP webhook mode after any channel save.

2. Tauri write_openclaw_config syncs providers to agents/*/models.json
   (Issue #127 fix) but the dev-api web shim did not, leaving Gateway
   with stale models.json after Models page saves in browser mode.

Add regression tests for both paths.

Co-authored-by: 晴天 <1186258278@users.noreply.github.com>

tests/dev-api-models-sync.test.js

@@ -0,0 +1,66 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+import { syncProvidersToAgentModels } from '../scripts/dev-api.js'
+
+test('Web API write 会同步 openclaw.json providers 到 agent models.json', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'clawpanel-models-sync-'))
+  try {
+    const modelsPath = path.join(tmp, 'agents', 'main', 'agent', 'models.json')
+    fs.mkdirSync(path.dirname(modelsPath), { recursive: true })
+    fs.writeFileSync(modelsPath, JSON.stringify({
+      providers: {
+        a: { baseUrl: 'http://old-a', models: [{ id: 'm1' }] },
+        b: { baseUrl: 'http://old-b', models: [{ id: 'm2' }] },
+      },
+    }, null, 2))
+
+    syncProvidersToAgentModels({
+      models: {
+        providers: {
+          a: { baseUrl: 'http://new-a', apiKey: 'key-a', models: [{ id: 'm1' }] },
+        },
+      },
+    }, tmp)
+
+    const synced = JSON.parse(fs.readFileSync(modelsPath, 'utf8'))
+    assert.equal(synced.providers.a.baseUrl, 'http://new-a')
+    assert.equal(synced.providers.a.apiKey, 'key-a')
+    assert.equal(synced.providers.b, undefined)
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('Web API provider sync 保留 agent models.json 中用户手动添加的 provider 模型列表', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'clawpanel-models-sync-'))
+  try {
+    const modelsPath = path.join(tmp, 'agents', 'main', 'agent', 'models.json')
+    fs.mkdirSync(path.dirname(modelsPath), { recursive: true })
+    fs.writeFileSync(modelsPath, JSON.stringify({
+      providers: {
+        a: {
+          baseUrl: 'http://old-a',
+          models: [{ id: 'm1' }, { id: 'custom-model' }],
+        },
+      },
+    }, null, 2))
+
+    syncProvidersToAgentModels({
+      models: {
+        providers: {
+          a: { baseUrl: 'http://new-a', models: [{ id: 'm1' }] },
+        },
+      },
+    }, tmp)
+
+    const synced = JSON.parse(fs.readFileSync(modelsPath, 'utf8'))
+    assert.equal(synced.providers.a.baseUrl, 'http://new-a')
+    assert.deepEqual(synced.providers.a.models, [{ id: 'm1' }, { id: 'custom-model' }])
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})