tests: gate the hermes vhost, and stop specs from silently not running

Two gaps behind the same near-miss.

1. **No spec covered hermes.franksdank.cloud** — the one guarded vhost whose
   upstream is a host address (`reverse_proxy 192.168.0.143:8787`) rather than a
   container name, because its service is host-networked. That is how a
   loopback-only bind could take the vhost down with a 502 and leave every gate
   green. tests/e2e/specs/17-hermes-vhost.spec.ts asserts what a dead upstream
   violates: no 5xx through the guard chain, no Caddy error page, and no app
   bytes to an unauthenticated raw client. It does not assert SSO-silence, since
   this app has its own password login.

2. **Specs are matched by number prefix, not globbed.** A spec file whose prefix
   is in no project silently never runs — which is exactly what happened to the
   new one until it was registered. The prefix is registered now, the comment in
   playwright.config.ts says why, and tests/e2e_scaffold.bats fails if any
   spec file matches no project.

The hermes-webui seam assertion is corrected too: it asserted the loopback bind
I wrongly imposed, and now asserts the real contract — the unit's bind must serve
the address the Caddyfile fronts it on.

tests/hermes_webui.bats

@@ -38,19 +38,22 @@ webui_service_yaml() {
     grep -q -- '--foreground' <<< "$y"
 }
 
-@test "hermes-webui binds loopback, not the LAN" {
-    local y
+@test "hermes-webui's bind serves the address Caddy fronts it on" {
+    local y caddy
     y=$(webui_service_yaml)
+    caddy="$REPO_ROOT/dankclaw/Caddyfile"
     grep -q 'HERMES_WEBUI_PASSWORD' <<< "$y" \
         || { echo "password gate missing"; return 1; }
-    # With Network=host there is no port forwarder: the app's own bind IS the
-    # exposure. The compose service this replaced published 127.0.0.1:8787:8787,
-    # and an early version of the unit bound 0.0.0.0 instead — which answered
-    # 200 on 192.168.0.143:8787 for anyone on the LAN (measured 2026-09-16).
-    grep -q 'Environment=HERMES_WEBUI_HOST=127.0.0.1' <<< "$y" \
-        || { echo "webui must bind loopback (HERMES_WEBUI_HOST=127.0.0.1)"; return 1; }
-    ! grep -q 'HERMES_WEBUI_HOST=0.0.0.0' <<< "$y" \
-        || { echo "webui must not bind 0.0.0.0 on a host network"; return 1; }
+    # This unit is host-networked, so Caddy cannot reach it by container name:
+    # hermes.franksdank.cloud proxies to the host's LAN address. The app's bind
+    # is therefore load-bearing for that vhost — a loopback-only bind was tried
+    # on 2026-09-16 and broke it (502), while host networking means there is no
+    # port forwarder to bridge the gap.
+    local upstream
+    upstream=$(grep -A 6 '^hermes\.franksdank\.cloud {' "$caddy" | grep -oE 'reverse_proxy [0-9.]+:[0-9]+' | head -1)
+    [ -n "$upstream" ] || { echo "no hermes vhost upstream in the Caddyfile"; return 1; }
+    grep -q 'Environment=HERMES_WEBUI_HOST=0.0.0.0' <<< "$y" \
+        || { echo "webui must bind all interfaces: $upstream cannot reach loopback"; return 1; }
 }
 
 @test "hermes-webui shares the gateway data volume and mounts the webui checkout" {