fix(studio): sanitize Hermes proxy asset URLs

[zakahan]

Summary

• remove private faasInstanceName and Authorization query parameters from Hermes WebUI asset URLs exposed through the Studio proxy
• preserve non-sensitive query parameters and keep the change scoped to Hermes WebUI
• add regression coverage for root-relative and relative Hermes asset URLs

Validation

• uv run pre-commit run --all-files
• uv run --no-sync --with pytest python -m pytest tests/cli/test_frontend_agent_proxy.py tests/cli/test_frontend_sandbox.py (39 passed)
• verified against a live Hermes Session HTML response: both private query keys drop from 53 occurrences to 0 after rewriting