fix(dashboard): persist and scope profile switching

[kiss-kedaya]

Summary

• add a profile switcher to the dashboard and persist the selected profile across reloads
• scope dashboard session/detail APIs to the selected Hermes profile
• reload cron job storage under the selected profile so cron lists stop leaking across agents
• add regression coverage for profile-scoped sessions and cron jobs

Test Plan

• pytest tests/hermes_cli/test_web_server.py -q
• npm run build
• verified /api/sessions and /api/cron/jobs return different data for default, minion1, and okx-trader

[curtisszmania-cytocync]

Would love to see this merged.

[teknium1]

Thanks for the dashboard profile-scoping work. The stated dashboard behavior is now implemented on current main, but this branch also contains unrelated image-backend changes that need separation before any salvage.

Problems

• Current main already scopes sessions and analytics via hermes_cli/web_server.py:9583-9608 and regression coverage at tests/hermes_cli/test_web_server.py:1154-1291; commit 62b4618e9 introduced that guarantee. Current profile persistence is handled by web/src/contexts/ProfileProvider.tsx:42-79, and cron profile storage by hermes_cli/web_server.py:10092-10170.
• The CPA addition introduces HERMES_IMAGE_BACKEND at tools/image_generation_tool.py:508; behavioral configuration must remain in config.yaml.
• The CPA output path at tools/image_generation_tool.py:640 hardcodes ~/.hermes, bypassing profile isolation.
• The PR's request scope mutates process-global HERMES_HOME (hermes_cli/web_server.py:150 on the PR head). Current main documents why await-safe context-local scoping is required at hermes_cli/web_server.py:13118-13148.

Suggested changes

• Split and rework the CPA integration against the established image-provider plugin path; retain config.yaml configuration and get_hermes_home() paths.

Automated hermes-sweeper review.

[teknium1]

This mutates process-global process state for an HTTP request. Because handlers using this scope can await, concurrent requests can read or restore the wrong profile. Please use the current context-local/direct-profile-open approach instead; current main documents the await-safety requirement in _config_profile_scope.

[teknium1]

HERMES_IMAGE_BACKEND is a new user-facing non-secret behavior setting. Please keep backend selection solely in image_gen config.yaml; .env is reserved for credentials.

[teknium1]

This hardcodes the default ~/.hermes path and writes a selected profile's generated image into the wrong home. Use get_hermes_home() / "images" so output remains profile-isolated.