Fix Hermes container: add gateway command, disable network-reachable API server

Without an explicit command the image launches the interactive CLI by
default, which immediately exits with 'Input is not a terminal' in a
detached container — it was doing nothing on every restart. Also disables
API_SERVER_ENABLED: Hermes itself warns at startup that a network-reachable
API server combined with the default unsandboxed 'local' terminal backend
gives any caller on the network full terminal/file access. Not needed yet
(Matrix is the actual interface) — can re-enable properly (with a sandboxed
terminal backend) if claude-agent ever needs to call Hermes programmatically.

docker-compose.yml

@@ -78,15 +78,20 @@ services:
       MATRIX_ALLOWED_USERS: ${MATRIX_HUMAN_USER_ID}
       MATRIX_REQUIRE_MENTION: "true"
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
-      # Exposed on the internal network only (see claude-agent's LITELLM_BASE_URL-style
+      # Left disabled: Hermes itself warns that a network-reachable API server combined
-      # usage pattern) — nothing publishes this port externally.
+      # with the default unsandboxed ('local') terminal backend gives any caller full
-      API_SERVER_ENABLED: "true"
+      # terminal/file access within the container. Matrix is the actual interface in use;
-      API_SERVER_HOST: 0.0.0.0
+      # re-enable (API_SERVER_HOST: 0.0.0.0) only alongside terminal.backend: docker if
-      API_SERVER_KEY: ${HERMES_API_SERVER_KEY}
+      # claude-agent ever needs to call Hermes programmatically.
+      API_SERVER_ENABLED: "false"
     volumes:
       - /home/william/hermes-data:/opt/data
     networks:
       - web
+    # Without this the image's default command launches the interactive CLI, which
+    # immediately exits ("Input is not a terminal") since a detached container has no
+    # stdin — the container then just sits there having done nothing, every restart.
+    command: ["gateway", "run"]
 
   claude-agent:
     image: ${GITEA_REGISTRY_IMAGE}