hermes: gateway dials the signal-cli daemon over loopback on host networking

The gateway unit ran on dankclaw_default and could not reach the host
daemon: from that network only DNAT'd published ports accept connections to
the LAN address. The compose era ran the gateway with network_mode: host, so
the daemon was reachable; the unit silently changed topology at takeover and
broke the adapter. Host networking + a loopback dial removes the dependency
entirely — the gateway is an outbound-only client and publishes nothing.

dankclaw/hermes/quadlet/hermes.container

@@ -10,10 +10,13 @@
 # (same splice pattern proven live on authentik-worker). The gateway drops to
 # the unprivileged hermes user (uid 10000) at runtime; /data is world-writable
 # on purpose so that unmapped uid can write agent.log and its state there.
-# SIGNAL_HTTP_URL uses the gateway alias, not the host LAN IP: from container
-# space on this network only DNAT'd published ports accept connections to the
-# LAN address; un-forwarded host ports refuse instantly (verified live
-# 2026-08-30). The alias resolves to the network's own gateway IP.
+#
+# Host networking: the adapter dials the signal-cli daemon, a HOST process
+# listening on :8080. The compose era dialed the host LAN IP from a bridge
+# network, where only DNAT'd published ports accept connections to that
+# address — un-forwarded host ports refuse instantly (verified live
+# 2026-08-30). A host-network client dials 127.0.0.1:8080 with no such
+# dependency, and the gateway publishes nothing inbound.
 
 [Unit]
 Description=Hermes agent gateway container
@@ -24,11 +27,11 @@ Wants=network-online.target
 ContainerName=hermes
 Image=localhost/hermes-agent:latest
 Pull=never
-Network=dankclaw_default
+NetworkMode=host
 EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
 Environment=HERMES_DATA_DIR=/data
 Environment=HERMES_HOME=/data
-Environment=SIGNAL_HTTP_URL=http://host.containers.internal:8080
+Environment=SIGNAL_HTTP_URL=http://127.0.0.1:8080
 Environment=SIGNAL_ACCOUNT=${SIGNAL_ACCOUNT}
 Environment=SIGNAL_ALLOWED_USERS=${SIGNAL_ALLOWED_USERS}
 Volume=/home/dank/hermes-data:/data