hermes: the webui was LAN-facing, not loopback — and Dankclaw's compose is gone

Two things, found while checking whether the hermes trio still needed migrating.

1. **The phone-facing webui was exposed to the LAN.** Its unit runs with
   Network=host, so there is no Podman port forwarder and the app's own bind is
   the exposure. The compose service it replaced published
   `127.0.0.1:8787:8787` (loopback); the unit bound `HERMES_WEBUI_HOST=0.0.0.0`,
   and the LAN address answered 200 — password-gated, but on every interface,
   which is not the documented "SSH tunnel is the sole ingress" posture. It now
   binds 127.0.0.1, which serves the tunnel just as well (sshd dials
   localhost:8787 from the host). The unit comment claiming "LAN-facing as
   before" was wrong about "before", and is corrected.

2. **Dankclaw's compose.yaml is retired.** Auditing ownership showed every
   running container on that host reports a PODMAN_SYSTEMD_UNIT label — the
   hermes trio's units have owned their containers since 2026-09-12 — so the
   three service blocks left in compose.yaml were dead weight that could only
   create a duplicate container fighting a unit for a name. deploy_hermes was
   already fully unit-based. The file is staged in .AGENTTRASH/; the planner
   plans nothing for it, an unknown service on that target now errors instead of
   silently no-oping through `podman-compose`, and DANKCLAW_COMPOSE_SERVICES is
   empty.

The hermes-webui seam now reads the unit — it read compose, which is exactly how
the bind drifted while the test kept passing against a file nobody ran.

dankclaw/hermes/quadlet/hermes-webui.container

@@ -14,9 +14,13 @@
 # daemon binds loopback-only in the host network namespace (see
 # chrome-devtools-protocol.container). Only processes sharing that namespace
 # can drive the browser; a bridge-network client could not reach it at all.
-# The server therefore listens on 0.0.0.0:8787 of the host netns (LAN-facing as
-# before); access control is the password gate, and the SSH tunnel
-# (phone -> Dankclaw:22) remains the sole off-network ingress path.
+# The server binds LOOPBACK (HERMES_WEBUI_HOST=127.0.0.1). Host networking
+# means there is no Podman port forwarder, so the bind IS the exposure: the
+# compose service this replaced published 127.0.0.1:8787:8787, and the first
+# version of this unit bound 0.0.0.0 instead, which put the phone-facing API on
+# the whole LAN with only the password in front of it (measured 2026-09-16:
+# 192.168.0.143:8787 answered 200). The SSH tunnel (phone -> Dankclaw:22) dials
+# localhost:8787 from the host, so loopback serves it exactly as well.
 
 [Unit]
 Description=Hermes webui (Hermex) container
@@ -27,7 +31,7 @@ Image=localhost/hermes-agent:latest
 Pull=never
 Network=host
 EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
-Environment=HERMES_WEBUI_HOST=0.0.0.0
+Environment=HERMES_WEBUI_HOST=127.0.0.1
 Environment=HERMES_WEBUI_PORT=8787
 Environment=HERMES_WEBUI_PASSWORD=${HERMES_WEBUI_PASSWORD}
 Environment=HERMES_HOME=/data