hermes-webui: add Hermex server as loopback compose service on Dankclaw

- compose: hermes-webui runs bootstrap.py --foreground in the agent image,
  shares /home/dank/hermes-data (same uid mapping as the gateway), publishes
  127.0.0.1:8787 only; password from host .env
- planner/remote deployer: hermes-webui is an isolated Dankclaw service
- tests: deployment integrity seam (loopback, auth, volume, healthcheck,
  planner narrowing, deployer dispatch)
- docs: Hermes-WebUI page with the iOS SSH-tunnel access pattern

dankclaw/.env.example

@@ -40,6 +40,11 @@ SIGNAL_ACCOUNT=+15551234567
 # Comma-separated E.164 numbers allowed to message the agent.
 SIGNAL_ALLOWED_USERS=+15551234567
 
+# Hermes web UI (Hermex server) login password. Required: the webui binds to
+# loopback and is reached only through the SSH tunnel, but Hermex still signs
+# in with this password. Set a strong value in the live .env.
+HERMES_WEBUI_PASSWORD=changeme
+
 # Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
 # for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
 # account-wide; rotate them here rather than in the dashboard.

dankclaw/compose.yaml

@@ -94,6 +94,41 @@ services:
     volumes:
       - /home/dank/hermes-data:/data
 
+  # --- Hermes web UI (Hermex server; phone-facing API for the agent) --------
+  # Runs the open-source hermes-webui (github.com/nesquena/hermes-webui) in
+  # foreground mode: bootstrap.py creates .venv inside the mounted checkout,
+  # installs WebUI + agent deps, then execs server.py as a single foreground
+  # process. It reads HERMES_HOME=/data, so it drives the SAME agent state
+  # (memory, skills, sessions) as the gateway container.
+  # Loopback-only publish: the SSH tunnel (phone -> Dankclaw:22) is the sole
+  # ingress. The password gates Hermex logins and lives in the host .env.
+  hermes-webui:
+    image: docker.io/nousresearch/hermes-agent:latest
+    container_name: hermes-webui
+    restart: unless-stopped
+    entrypoint: ["bash", "-c", "python3 /webui/bootstrap.py --foreground"]
+    environment:
+      HERMES_HOME: /data
+      HERMES_WEBUI_HOST: 127.0.0.1
+      HERMES_WEBUI_PORT: "8787"
+      HERMES_WEBUI_PASSWORD: "${HERMES_WEBUI_PASSWORD}"
+      # Headless host: never show the first-run wizard (a profile already
+      # exists in /data from the gateway).
+      HERMES_WEBUI_SKIP_ONBOARDING: "1"
+    ports:
+      - "127.0.0.1:8787:8787"
+    volumes:
+      - /home/dank/hermes-data:/data
+      # rw on purpose: bootstrap.py creates /webui/.venv in the repo root.
+      - /home/dank/hermes-webui:/webui
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/health')"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      # First boot pip-installs WebUI + agent deps into a fresh venv.
+      start_period: 600s
+
   # --- Git hosting (Gitea) -------------------------------------------------
   # Now boot-persistent Quadlet units (private bridge network, DNS enabled),
   # not compose services. See gitea/quadlet/ and ../docs/Dankclaw/Gitea.md.