fix(hermes): point the signal adapter at the verified alias path and route hermes.franksdank.cloud to the dashboard

The gateway's SIGNAL_HTTP_URL pointed at the host LAN IP. From container
space on netavark networks only DNAT'd published ports accept connections
to that address; :8080 has no forward, so every connection was refused
and the Signal adapter stayed disconnected since the Aug 26 reboot.
host.containers.internal is the verified working path (probed live from a
probe container on dankclaw_default).

The public hostname also routed to hermes:8090, which serves nothing —
the gateway has no HTTP listener. It now routes to the dashboard's login-
gated admin UI on :9119, behind the existing Anubis+Authentik guard.

dankclaw/Caddyfile

@@ -284,7 +284,7 @@ http://:8017 {
 
 	@hermes host hermes.franksdank.cloud
 	handle @hermes {
-		reverse_proxy hermes:8090
+		reverse_proxy 192.168.0.143:9119
 	}
 
 	@prometheus host prometheus.franksdank.cloud

dankclaw/compose.yaml

@@ -62,10 +62,11 @@ services:
       HERMES_DATA_DIR: /data
       # Point hermes's config/.env at the mounted data dir (persistent).
       HERMES_HOME: /data
-      # Signal adapter -> the host signal-cli daemon. The slirp host alias
-      # (host.containers.internal) can drop at runtime; the host LAN IP is the
-      # stable container->host path. 127.0.0.1 inside the container is not the host.
-      SIGNAL_HTTP_URL: "http://192.168.0.143:8080"
+      # Signal adapter -> the host signal-cli daemon (:8080, host process).
+      # From container space the host LAN IP only accepts connections to
+      # published ports (netavark DNAT); un-forwarded host ports refuse
+      # instantly. The gateway alias is the verified working path (2026-08-30).
+      SIGNAL_HTTP_URL: "http://host.containers.internal:8080"
       SIGNAL_ACCOUNT: "${SIGNAL_ACCOUNT}"
       SIGNAL_ALLOWED_USERS: "${SIGNAL_ALLOWED_USERS}"
     ports: