docs(hermes): document namespace addressability and fix stale claims

New page Architecture/Container Network Namespaces.md: which local services are
addressable from which Podman network namespace on Dankclaw (rootless podman +
netavark). Verified live 2026-09-02: gateway/webui/CDP run in the host netns and
dial loopback; hermes-dashboard is the only Hermes container on a bridge network
(dankclaw_default, 10.89.1.0/24 gw 10.89.1.1) and can dial published ports only —
unpublished host-netns listeners (signal-cli :8080, webui :8787) are refused from
that namespace even though both bind 0.0.0.0.

Corrected while verifying the above:
- Hermes.md: data root is /home/dank/Containers/hermes/data (not the retired
  /home/dank/hermes-data); gateway dials the Signal daemon on loopback; the
  daemon itself is a host user unit (signal-cli-daemon.service) bound to
  0.0.0.0:8080, so the Signal HTTP API is LAN-reachable.
- Hermes-Dashboard.md: it is a Quadlet unit (Network=dankclaw_default), not a
  compose service; data root + /opt/data anonymous volume corrected.
- Hermes-WebUI.md: binds 0.0.0.0:8787 in the host netns (verified: unauthenticated
  GET /health from another LAN machine returned 200) — the SSH tunnel is an access
  path, not a containment boundary; HealthCmd and data-path corrections.
- Network Architecture.md: no hermes vhost exists in either the tracked or the live
  Caddyfile (hermes.franksdank.cloud resolves but routes nowhere); SearXNG exits the
  tunnel via the shared named network searxng.network, not service:gluetun.

Docs only — deploy is a no-op for this change.

serverAppConfigs-docs/Dankclaw/Hermes.md

@@ -4,8 +4,11 @@ Hermes is the self-improving AI agent from Nous Research. It runs in a terminal,
 
 **Host:** Dankclaw — **Hostname:** `hermes.dankclaw.local` — **Docs:** https://hermes-agent.nousresearch.com/docs
 
-**Persistent state:** `/home/dank/hermes-data` on Dankclaw, mounted as `/data` in
-both containers. The tracked, sanitized configuration baseline is
+**Persistent state:** `/home/dank/Containers/hermes/data` on Dankclaw, bind-mounted
+at `/data` in all three Hermes containers (gateway, webui, dashboard). Each
+container additionally gets an anonymous volume at `/opt/data`, which is
+re-created empty on every container recreation — anything that lives only there
+is not durable. The tracked, sanitized configuration baseline is
 [`dankclaw/hermes/config.yaml.example`](../../dankclaw/hermes/config.yaml.example).
 
 ## Facts (from research, primary source)
@@ -22,7 +25,12 @@ both containers. The tracked, sanitized configuration baseline is
 ## Configuration
 
 - Point Hermes at the local model endpoint or an external provider through its provider config.
-- The gateway process exposes one port for chat integration; the exact port is set in the Hermes config (`8090` convention in this repo).
+- The gateway runs `hermes gateway run --force -v` in the **host** network
+  namespace (`Network=host` in its Quadlet unit) and reaches the Signal daemon at
+  `http://127.0.0.1:8080`. That loopback hop works only because the gateway is in
+  the host netns — see [[Container Network Namespaces]]. The daemon itself is a
+  **host** user unit (`signal-cli-daemon.service`), not a container, and binds
+  `0.0.0.0:8080`, so the Signal HTTP API is reachable from the whole LAN.
 - The data volume persists skills, memory, and session history.
 - Hermes has two named local providers: `dankclaw-large` reaches
   `http://192.168.0.143:7770/v1` and exposes `frank-default-large`;
@@ -33,9 +41,11 @@ both containers. The tracked, sanitized configuration baseline is
 
 ## Volumes
 
-| Container path | Host path (convention) |
-|----------------|------------------------|
-| `/data` | `/home/dank/hermes-data` |
+| Container path | Host path (live) | Backing |
+|----------------|------------------|---------|
+| `/data` | `/home/dank/Containers/hermes/data` | bind mount (durable; shared by all three containers) |
+| `/webui` | `/home/dank/Containers/hermes/webui` | bind mount (webui only — the `bootstrap.py` venv lives here) |
+| `/opt/data` | anonymous volume | image `VOLUME`; fresh empty volume per recreation |
 
 ## Gotchas
 
@@ -64,3 +74,4 @@ restart) pays one first-call npm download; subsequent calls are cached.
 - [[Dankclaw Stack]]
 - [[OpenWebUI]] — the chat UI that pairs with Hermes
 - Knowledge base: [[SearXNG]] (Hermes as the search agent)
+- [[Container Network Namespaces]] — why the gateway and webui can dial loopback services and the dashboard cannot