hermes-webui: bind 0.0.0.0 inside the container (host publish stays loopback)

Podman's port forwarder dials the container bridge IP; a container-internal
loopback bind made every tunneled connection reset.

dankclaw/compose.yaml

@@ -109,7 +109,10 @@ services:
     entrypoint: ["bash", "-c", "python3 /webui/bootstrap.py --foreground"]
     environment:
       HERMES_HOME: /data
-      HERMES_WEBUI_HOST: 127.0.0.1
+      # Container-internal bind: 0.0.0.0 so Podman's port forwarder (which
+      # dials the container's bridge IP) can reach it. The *host-side*
+      # publish below stays on 127.0.0.1, so loopback-only ingress holds.
+      HERMES_WEBUI_HOST: 0.0.0.0
       HERMES_WEBUI_PORT: "8787"
       HERMES_WEBUI_PASSWORD: "${HERMES_WEBUI_PASSWORD}"
       # Headless host: never show the first-run wizard (a profile already