docs(hermes): document namespace addressability and fix stale claims

New page Architecture/Container Network Namespaces.md: which local services are
addressable from which Podman network namespace on Dankclaw (rootless podman +
netavark). Verified live 2026-09-02: gateway/webui/CDP run in the host netns and
dial loopback; hermes-dashboard is the only Hermes container on a bridge network
(dankclaw_default, 10.89.1.0/24 gw 10.89.1.1) and can dial published ports only —
unpublished host-netns listeners (signal-cli :8080, webui :8787) are refused from
that namespace even though both bind 0.0.0.0.

Corrected while verifying the above:
- Hermes.md: data root is /home/dank/Containers/hermes/data (not the retired
  /home/dank/hermes-data); gateway dials the Signal daemon on loopback; the
  daemon itself is a host user unit (signal-cli-daemon.service) bound to
  0.0.0.0:8080, so the Signal HTTP API is LAN-reachable.
- Hermes-Dashboard.md: it is a Quadlet unit (Network=dankclaw_default), not a
  compose service; data root + /opt/data anonymous volume corrected.
- Hermes-WebUI.md: binds 0.0.0.0:8787 in the host netns (verified: unauthenticated
  GET /health from another LAN machine returned 200) — the SSH tunnel is an access
  path, not a containment boundary; HealthCmd and data-path corrections.
- Network Architecture.md: no hermes vhost exists in either the tracked or the live
  Caddyfile (hermes.franksdank.cloud resolves but routes nowhere); SearXNG exits the
  tunnel via the shared named network searxng.network, not service:gluetun.

Docs only — deploy is a no-op for this change.

serverAppConfigs-docs/Dankclaw/Hermes-Dashboard.md

@@ -12,17 +12,36 @@ The Hermes web dashboard is a browser UI for managing the agent. It shows config
 | Command | `hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build` |
 | Port | `9119` (published to the LAN) |
 | Auth | HTTP basic auth (username + scrypt password hash) |
-| Data | shares `/home/dank/hermes-data` with the gateway |
+| Data | bind mount `/home/dank/Containers/hermes/data` → `/data`, shared with the gateway; plus a fresh anonymous volume at `/opt/data` per recreation |
 
 ## Why a separate container
 
-The gateway container runs `hermes gateway run` (the Signal platform). That entrypoint does not start the dashboard. The dashboard is a separate process. So it runs in its own compose service (`hermes-dashboard`). Both services mount the same data volume. Both restart at boot (`restart: unless-stopped`).
+The gateway container runs `hermes gateway run` (the Signal platform). That
+entrypoint does not start the dashboard. The dashboard is a separate process, so
+it runs in its own Quadlet unit
+([`dankclaw/hermes/quadlet/hermes-dashboard.container`](../../dankclaw/hermes/quadlet/hermes-dashboard.container):
+image `localhost/hermes-agent:latest`, `Pull=never`, `Exec=hermes dashboard
+--host 0.0.0.0 --port 9119 --no-open --skip-build`, `Restart=always`,
+`RestartSec=5`). All three Hermes containers mount the same `/data` bind mount.
+
+Unlike its two siblings — `hermes.container` and `hermes-webui.container` both
+run with `Network=host` — the dashboard is the only Hermes container on a bridge
+network (`Network=dankclaw_default`, subnet `10.89.1.0/24`, gateway `10.89.1.1`).
+That has a functional consequence: from inside its namespace it can dial only
+published ports via the gateway IP, and `host.containers.internal`
+(`169.254.1.2`) is an alias on the *default* `podman` network that this container
+is not attached to, so probes to it time out. It therefore never talks to the
+gateway, the webui, or the CDP daemon over the network — it shares their state
+through the bind mount instead. See [[Container Network Namespaces]].
 
 ## Authentication
 
 The dashboard refuses to bind to a non-loopback address without an auth provider. There is no unauthenticated public bind. This repo uses basic auth:
 
-- `dashboard.basic_auth.username` and `dashboard.basic_auth.password_hash` live in the live `/home/dank/hermes-data/config.yaml`; the tracked backup at `dankclaw/hermes/config.yaml.example` intentionally omits the password hash.
+- `dashboard.basic_auth.username` and `dashboard.basic_auth.password_hash` live in
+  the live `/data/config.yaml` (host path
+  `/home/dank/Containers/hermes/data/config.yaml`); the tracked backup at
+  `dankclaw/hermes/config.yaml.example` intentionally omits the password hash.
 - The stored value is a one-way scrypt hash. The plaintext password is never written to a file or the repo.
 - The hash is generated with `plugins.dashboard_auth.basic.hash_password`.
 
@@ -39,3 +58,4 @@ Open `http://192.168.0.143:9119` in a browser on the LAN. Log in with the config
 ## See Also
 
 - [[Hermes-WebUI]] — the phone-facing API server (Hermex)
+- [[Container Network Namespaces]] — why this container cannot dial the gateway, webui, or CDP daemon