Add Hermes Agent as a second native Matrix presence

Deployed as its own service (pinned nousresearch/hermes-agent:v2026.8.19),
own Matrix bot account (@hermes), own OpenRouter-backed model config, and
its own OpenAI-compatible API server (internal network only, for possible
future use by claude-agent). Joins the same control room but only responds
when explicitly @mentioned, restricted to the human user — no conflict with
claude-bot's default no-prefix chat routing. claude-agent's router now
ignores messages addressed to @hermes so both bots don't answer the same
message.

Bridge networking (the 'web' network), not the image's default host mode —
no reason for an agent container to share the host's network namespace when
everything it needs (the homeserver, OpenRouter) is reachable over the
existing bridge.

.env.example

@@ -40,6 +40,17 @@ OPENROUTER_API_KEY=
 # Any random string; also used as litellm's general_settings.master_key.
 LITELLM_MASTER_KEY=
 
+# --- hermes (autonomous agent with its own native Matrix presence) ---
+# Your own Matrix ID — Hermes only responds to this user, and only when @mentioned
+# in a shared room (e.g. "@hermes <task>" in the control room).
+MATRIX_HUMAN_USER_ID=@william:matrix.apps.williamturner.eu
+# Access token for the @hermes bot account (register it the same way as claude-bot —
+# see README — then log in as it via /_matrix/client/v3/login to get this token).
+HERMES_MATRIX_ACCESS_TOKEN=
+# Any random string — bearer key for Hermes's own OpenAI-compatible API server
+# (internal network only, not published anywhere).
+HERMES_API_SERVER_KEY=
+
 # --- portainer (GitOps redeploy) ---
 PORTAINER_STACK_WEBHOOK_URL=