feat(cli): add --insecure-chat flag for non-loopback WS chat clients

[qpilotwave]

What does this PR do?

The embedded TUI Chat tab (hermes dashboard --tui) rejects WebSocket connections from non-loopback IPs to prevent unauthorized remote access to the PTY. This is correct for localhost-only use, but blocks usage over Tailscale, VPNs, or LAN when the dashboard is intentionally bound to a non-loopback address with --insecure.

Add --insecure-chat which, when combined with --tui, skips the ws.client.host loopback check on all chat WebSocket endpoints:

• /api/pty
• /api/ws
• /api/pub
• /api/events

Update the web-dashboard docs to document the new flag, clarify that the Chat tab only appears when --tui is passed.

Related Issue

#15731

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• Add --insecure-chat flag parsing: hermes_cli/main.py
• Skip checks when --insecure-chat flag is passed: hermes_cli/web_server.py
• Document new flag, clarify that --tui flag in hermes dashboard command: website/docs/user-guide/features/web-dashboard.md

How to Test

1. run hermes dashboard --tui --host 0.0.0.0 --insecure --insecure-chat
2. go to chat tab in Hermes web dashboard (use non-loopback ip address of the host)
3. confirm you can chat with the agent

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Arch Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

[teknium1]

Thanks for the remote-chat contribution. This is an automated hermes-sweeper review; current main already provides the requested behavior through the authenticated remote-dashboard path, so the separate --insecure-chat escape hatch is redundant.

• 234ac009376daba225525195afca96be8a82634c fixed remote chat WebSocket peers for explicit non-loopback/Tailscale/LAN binds and added regression coverage.
• hermes_cli/web_server.py:393-412 now requires authentication for every non-loopback bind; --insecure no longer bypasses that gate.
• hermes_cli/web_server.py:14265-14281 permits remote peers for gated/non-loopback dashboards while retaining the Host/Origin guard; /api/pty, /api/ws, /api/pub, and /api/events apply this policy at 15350-15370 and 15521-15586.
• The documented remote setup uses an authenticated --host 0.0.0.0 dashboard at website/docs/user-guide/features/web-dashboard.md:142-166.

Closing as implemented on main.