hermes-webui: bind 0.0.0.0 inside the container (host publish stays loopback)

Podman's port forwarder dials the container bridge IP; a container-internal
loopback bind made every tunneled connection reset.

tests/hermes_webui.bats

@@ -38,6 +38,9 @@ PYEOF
     # Host-side publish stays on loopback: the SSH tunnel is the only ingress.
     grep -q '127.0.0.1:8787' <<< "$y"
     grep -q 'HERMES_WEBUI_PASSWORD' <<< "$y"
+    # Container-internal bind must be 0.0.0.0 or Podman's port forwarder
+    # (which dials the bridge IP) resets every connection.
+    grep -q 'HERMES_WEBUI_HOST: 0.0.0.0' <<< "$y"
 }
 
 @test "hermes-webui shares the gateway data volume and mounts the webui checkout" {