Add Hermes web dashboard at hermes.apps.williamturner.eu

Enabled via HERMES_DASHBOARD=1 (supervised in-container alongside the
gateway, per docs/user-guide/docker.md), bound to 0.0.0.0:9119 so Traefik
can reach it. Two independent auth layers, not one:

1. Traefik basicauth middleware in front of the whole route.
2. Hermes's own basic-auth gate (mandatory once the bind is non-loopback).

Hermes's docs explicitly call basic-auth-alone "not suitable for direct
public-internet exposure" and cite a real June 2026 incident where
internet scanners reached exposed dashboards and drove agents into
planting SSH-key backdoors — hence the extra Traefik-level gate rather
than relying on Hermes's own login page alone.

Also fixes: the htpasswd hash for Traefik's basicauth needs its literal
'$' characters escaped as '2824147' in .env, or docker compose's own variable
interpolation corrupts it (mistook '' for further
 references). Also switched the hash from Python's default SHA-512
crypt ('$...') to apr1 ('$...', via openssl passwd -apr1) —
Traefik's basicauth middleware doesn't accept SHA-512-crypt.

Also re-adds Hermes's OPENAI_BASE_URL/OPENAI_API_KEY routing through the
local litellm gateway (instead of OPENROUTER_API_KEY direct) — this was
part of the now-abandoned PR #12 and never actually landed on main.

.env.example

@@ -5,6 +5,7 @@
 # --- domain / TLS ---
 MATRIX_SERVER_NAME=matrix.apps.williamturner.eu
 AGENT_HOSTNAME=agent.apps.williamturner.eu
+HERMES_DASHBOARD_HOSTNAME=hermes.apps.williamturner.eu
 # Set to true ONLY for the first-boot window while creating the bot account,
 # then back to false (or unset) and redeploy. See README.
 MATRIX_ALLOW_REGISTRATION=false
@@ -37,6 +38,18 @@ HERMES_MATRIX_ACCESS_TOKEN=
 # (internal network only, not published anywhere).
 HERMES_API_SERVER_KEY=
 
+# --- hermes web dashboard (hermes.apps.williamturner.eu) ---
+# Two independent auth layers: Hermes's own login (basic auth — its docs call this
+# "not suitable for direct public-internet exposure" alone) plus a Traefik-level basic
+# auth gate in front of it. Both required, different credentials recommended.
+HERMES_DASHBOARD_USERNAME=william
+HERMES_DASHBOARD_PASSWORD=
+# 32+ random bytes — `openssl rand -base64 32`
+HERMES_DASHBOARD_SECRET=
+# htpasswd-format "user:hash" for Traefik's basicauth middleware. Generate with:
+#   python3 -c "import crypt; print('someuser:' + crypt.crypt('somepassword', crypt.mksalt(crypt.METHOD_SHA512)))"
+TRAEFIK_HERMES_AUTH_HASH=
+
 # --- portainer (GitOps redeploy) ---
 PORTAINER_STACK_WEBHOOK_URL=