hermes: add web dashboard service (basic-auth, LAN port 9119)

Add a hermes-dashboard compose service that runs 'hermes dashboard' on
0.0.0.0:9119 with HTTP basic auth. The username + scrypt password hash
live in the git-ignored /home/dank/hermes-data config (plaintext never
stored). A separate container from the Signal gateway, since the gateway
entrypoint does not start the dashboard. Both share the data volume and
are boot-persistent. Docs page + index link added (docs-first contract).

dankclaw/compose.yaml

@@ -89,6 +89,24 @@ services:
     # SSE), not the :8090 web dashboard, so there is no HTTP endpoint to probe.
     # The container's running state + the daemon's SSE connection are the signal.
 
+  # --- Hermes web dashboard (management UI: config, API keys, sessions) -----
+  # A separate process from the Signal gateway (the gateway entrypoint does not
+  # start the dashboard). Bound to the LAN with basic auth: the username + a
+  # scrypt password_hash live in the git-ignored /home/dank/hermes-data config.
+  # Port 9119 is published so a browser on the LAN can reach it.
+  hermes-dashboard:
+    image: docker.io/nousresearch/hermes-agent:latest
+    container_name: hermes-dashboard
+    restart: unless-stopped
+    entrypoint: ["bash", "-c", "hermes dashboard --host 0.0.0.0 --port 9119 --no-open --skip-build"]
+    environment:
+      HERMES_DATA_DIR: /data
+      HERMES_HOME: /data
+    ports:
+      - "9119:9119"
+    volumes:
+      - /home/dank/hermes-data:/data
+
   # --- Git hosting (migrated from /opt/gitea) ------------------------------
   postgres:
     image: docker.io/library/postgres:16-alpine