hermes-webui: bind 0.0.0.0 inside the container (host publish stays loopback)

Podman's port forwarder dials the container bridge IP; a container-internal
loopback bind made every tunneled connection reset.

dankclaw/compose.yaml

@@ -109,7 +109,10 @@ services:
     entrypoint: ["bash", "-c", "python3 /webui/bootstrap.py --foreground"]
     environment:
       HERMES_HOME: /data
-      HERMES_WEBUI_HOST: 127.0.0.1
+      # Container-internal bind: 0.0.0.0 so Podman's port forwarder (which
+      # dials the container's bridge IP) can reach it. The *host-side*
+      # publish below stays on 127.0.0.1, so loopback-only ingress holds.
+      HERMES_WEBUI_HOST: 0.0.0.0
       HERMES_WEBUI_PORT: "8787"
       HERMES_WEBUI_PASSWORD: "${HERMES_WEBUI_PASSWORD}"
       # Headless host: never show the first-run wizard (a profile already

tests/hermes_webui.bats

@@ -38,6 +38,9 @@ PYEOF
     # Host-side publish stays on loopback: the SSH tunnel is the only ingress.
     grep -q '127.0.0.1:8787' <<< "$y"
     grep -q 'HERMES_WEBUI_PASSWORD' <<< "$y"
+    # Container-internal bind must be 0.0.0.0 or Podman's port forwarder
+    # (which dials the bridge IP) resets every connection.
+    grep -q 'HERMES_WEBUI_HOST: 0.0.0.0' <<< "$y"
 }
 
 @test "hermes-webui shares the gateway data volume and mounts the webui checkout" {