docs: update README and OpenAPI spec to v0.4.4 (#147)

- Add File Browser, Session search, Authentication sections to README (EN + ZH)
- Update Model Management with Nous Portal auth and non-v1 URL support
- Update OpenAPI spec from 0.2.6 to 0.4.4
- Add 30+ new endpoints: Auth, Files, Download, Gateways, Codex/Nous OAuth, Update
- Add PUT provider endpoint for updating existing providers
- Update HealthResponse with webui_version, webui_update_available, node_version fields

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -45,6 +45,7 @@
 - Tool call detail expansion (arguments / result)
 - File upload support
 - File download support — download user-uploaded files and agent-generated files across local, Docker, SSH, and Singularity backends
+- Session search — Ctrl+K global search across all conversations
 - Global model selector — discovers models from `~/.hermes/auth.json` credential pool
 - Per-session model display badge and context token usage
 
@@ -87,7 +88,8 @@ Unified configuration for **8 platforms** in one page:
 - Auto-discover models from credential pool (`~/.hermes/auth.json`)
 - Fetch available models from each provider endpoint (`/v1/models`)
 - Add, update, and delete providers (preset & custom OpenAI-compatible)
-- OpenAI Codex OAuth login for Codex models
+- OpenAI Codex & Nous Portal OAuth login
+- Provider URL auto-detection for non-v1 API versions (e.g. `/v4`)
 - Provider-level model grouping with default model switching
 
 ### Multi-Profile & Gateway
@@ -99,6 +101,13 @@ Unified configuration for **8 platforms** in one page:
 - Auto port conflict resolution
 - Profile-scoped configuration and cache isolation
 
+### File Browser
+
+- Browse files on remote backends (local, Docker, SSH, Singularity)
+- Upload, download, rename, copy, move, and delete files
+- Create directories
+- View file content with syntax highlighting
+
 ### Skills & Memory
 
 - Browse and search installed skills
@@ -111,6 +120,12 @@ Unified configuration for **8 platforms** in one page:
 - Filter by log level, log file, and keyword
 - Structured log parsing with HTTP access log highlighting
 
+### Authentication
+
+- Token-based auth (auto-generated on first run or set via `AUTH_TOKEN` env var)
+- Optional username/password login — set via settings page after initial token auth
+- Auth can be disabled with `AUTH_DISABLED=1`
+
 ### Settings
 
 - Display (streaming, compact mode, reasoning, cost display)