hermes: boot-persistent quadlet units for the gateway, dashboard, and webui

The trio ran as bare compose containers and died silently at the Aug 26
reboot — nothing restarts compose containers at boot. Each now has a
boot-persistent unit (WantedBy=default.target; the v1 quadlet generator on
this host cannot enable generated units). The deploy handler retires the
compose-era containers only while the units are not yet active, then
(re)starts each unit.

Units run the image under a localhost/hermes-agent:latest alias tag (the
quadlet create path on this host cannot resolve registry-prefixed refs from
local storage); the deploy handler tags first. The gateway's :8090 publish
is dropped — nothing consumes it; the public vhost now routes to the
dashboard's login-gated UI on 9119.

scripts/deploy-remote.sh

@@ -566,6 +566,33 @@ deploy_authentik_outpost() {
         echo "WARN: authentik-outpost did not come up active" >&2
 }
 
+deploy_hermes() {
+    # The hermes trio (gateway, dashboard, webui) shares one image and the
+    # /data volume and deploys as one unit: install the units, retire the
+    # compose-era containers holding the claimed names while the units are not
+    # yet active, then restart each unit. An explicit hermes deploy is a
+    # deliberate action, so restarting an already-running trio is intended.
+    # Boot persistence comes from [Install] in each unit file (generated units
+    # cannot be enabled by this host's v1 quadlet generator).
+    local unit
+    mkdir -p "$quadlet_unit_dir"
+    # The units run the image under a localhost/-aliased tag: this host's
+    # quadlet path can fail to resolve registry-prefixed refs from local
+    # storage at create time. Tag first, then (re)create via deploy.
+    podman tag docker.io/nousresearch/hermes-agent:latest localhost/hermes-agent:latest 2>/dev/null || true
+    for unit in hermes hermes-dashboard hermes-webui; do
+        cp "dankclaw/hermes/quadlet/$unit.container" "$quadlet_unit_dir/"
+    done
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active --quiet hermes.service; then
+        podman stop hermes hermes-dashboard hermes-webui 2>/dev/null || true
+        podman rm hermes hermes-dashboard hermes-webui 2>/dev/null || true
+    fi
+    systemctl --user restart hermes.service
+    systemctl --user restart hermes-dashboard.service
+    systemctl --user restart hermes-webui.service
+}
+
 deploy_anubis() {
     # Anubis is the bot-challenge proxy in front of the guarded vhosts.
     # The image lives on ghcr.io; pull once, then the unit runs it from
@@ -660,6 +687,7 @@ deploy_service() {
         frank-default-small) deploy_llm_small ;;
         frank-default-npu) deploy_llm_npu ;;
         frank-default-sightsound) deploy_llm_sightsound ;;
+        hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
         *) deploy_compose_service "$service" ;;
     esac
 }