fix: support proxied dashboard chat sessions

[hejun041]

Summary

• remove systemd restart backoff keys that are unsupported by older systemd releases
• make dashboard WebSocket handling work behind a trusted local reverse proxy
• fix the TUI build freshness check to look for the actual built artifact (entry-exports.js)
• surface recently active repeated-compression session chains on the dashboard /sessions page

Details

• Drops RestartMaxDelaySec / RestartSteps from the generated gateway systemd unit so it works on older systemd versions (e.g. systemd 245).
• Starts the dashboard Uvicorn server with proxy_headers=True and forwarded_allow_ips="127.0.0.1,::1" so local reverse proxies can pass through the original client/host information without trusting arbitrary remote forwarded headers.
• Allows /api/pty WebSocket handshakes from a trusted local reverse proxy when the forwarded/Host header still matches the dashboard bind host, while preserving the DNS-rebinding guard for non-loopback clients.
• Updates _hermes_ink_bundle_stale() to check ui-tui/packages/hermes-ink/dist/entry-exports.js instead of the removed ink-bundle.js, avoiding needless rebuilds during dashboard chat connection startup.
• Fixes repeated context-compression chains so /api/sessions projects to the latest live tip even when an intermediate compression anchor itself has a parent, and sorts dashboard sessions by last activity.

Test Plan

• venv/bin/python -m pytest tests/hermes_cli/test_gateway.py tests/hermes_cli/test_tui_npm_install.py tests/hermes_cli/test_web_server_host_header.py tests/hermes_cli/test_web_server.py::TestPtyWebSocket -q -o 'addopts='
• venv/bin/python -m pytest tests/test_hermes_state.py::TestListSessionsRich tests/test_hermes_state.py::TestCompressionChainProjection tests/hermes_cli/test_web_server.py::TestPtyWebSocket tests/hermes_cli/test_web_server_host_header.py -q -o 'addopts='
• Manual local dashboard /api/pty WebSocket handshake returned HTTP/1.1 101 Switching Protocols.
• Manual local /api/sessions?limit=20&offset=0 check confirmed a repeatedly-compressed active session now appears in the first page.

Note

The TUI artifact freshness change overlaps with existing PRs called out in review (#20951, #20686, #21098). The systemd/reverse-proxy/session-list fixes are independent.

[alt-glitch]

Note: The TUI bundle staleness fix (point 3) in this PR overlaps with #20951, #20686, and #21098 which all fix _hermes_ink_bundle_stale() checking the wrong filename (ink-bundle.js → entry-exports.js).

[hejun041]

Added a follow-up commit fix: surface recently compressed dashboard sessions after checking for overlapping upstream/open-PR fixes. I found related resume/compression PRs (#15742, #13374) but not an existing fix for the dashboard /sessions list hiding repeated-compression tips or for /api/sessions ordering by last activity.

Additional validation:

• venv/bin/python -m pytest tests/test_hermes_state.py::TestListSessionsRich tests/test_hermes_state.py::TestCompressionChainProjection tests/hermes_cli/test_web_server.py::TestPtyWebSocket tests/hermes_cli/test_web_server_host_header.py -q -o 'addopts=' → 42 passed
• Local /api/sessions?limit=20&offset=0 now surfaces the active repeated-compression session on the first page.

[teknium1]

Thanks for the focused compatibility and dashboard investigation. The systemd, TUI-staleness, and session-list portions have since landed through later changes, but the reverse-proxy portion needs a narrower rework.

Problems

• hermes_cli/web_server.py:2920 changes only the peer-IP predicate. The WebSocket Host/Origin gate is separate and runs first on current main at hermes_cli/web_server.py:14335; it still rejects a public browser Origin for a loopback-bound dashboard. The linked #54072 discussion confirms this exact gap in this PR.
• hermes_cli/web_server.py:4086 enables proxy_headers for every bind. Current main deliberately keeps it disabled for loopback binds and enables it only for authenticated public binds (hermes_cli/web_server.py:17030-17037) to preserve the loopback peer boundary.

Suggested changes

• Salvage the remaining proxy case through the existing Host/Origin policy and configured trusted public URL, with end-to-end WebSocket coverage for both acceptance and rejection cases.
• Keep the current conditional proxy_headers policy; omit portions already superseded by 4d18717b6 and c6ca11618.

Automated hermes-sweeper review.

[teknium1]

This changes only the peer-IP check. A normal public reverse proxy still presents a browser Origin for its public hostname, while the separate Host/Origin guard compares that Origin to the loopback bound_host; this PR does not modify that path, so the reported origin_mismatch remains. Please route the configured trusted public URL through the Host/Origin policy rather than bypassing this peer check.

[teknium1]

Do not enable proxy headers unconditionally for loopback binds. The current design keeps the loopback peer as the security boundary and enables forwarded-header handling only for authenticated public binds; preserve that distinction when salvaging the proxy case.