LAN clients now connect directly to 192.168.0.143:8787 (password-gated via HERMES_WEBUI_PASSWORD); the SSH tunnel via port 22 remains the sole off-network ingress. Recreation also re-reads the rotated password from dankclaw/.env via the [Container] EnvironmentFile.