hermes-webui: add Hermex server as loopback compose service on Dankclaw

- compose: hermes-webui runs bootstrap.py --foreground in the agent image,
  shares /home/dank/hermes-data (same uid mapping as the gateway), publishes
  127.0.0.1:8787 only; password from host .env
- planner/remote deployer: hermes-webui is an isolated Dankclaw service
- tests: deployment integrity seam (loopback, auth, volume, healthcheck,
  planner narrowing, deployer dispatch)
- docs: Hermes-WebUI page with the iOS SSH-tunnel access pattern

scripts/deploy-plan.py

@@ -30,6 +30,7 @@ SERVICE_ORDER = (
     "comfyui",
     "hermes",
     "hermes-dashboard",
+    "hermes-webui",
     "prometheus",
     "grafana",
     "loki",
@@ -58,6 +59,7 @@ SERVICE_ORDER = (
 )
 
 DANKCLAW_SERVICES = {
+    "hermes-webui",
     "gluetun",
     "searxng-valkey",
     "searxng",
@@ -102,6 +104,7 @@ DANKCLAW_COMPOSE_SERVICES = {
     "comfyui",
     "hermes",
     "hermes-dashboard",
+    "hermes-webui",
     "prometheus",
     "grafana",
     "loki",