Add dashboard TLS and allowed-host flags

[anitguru]

Summary

• Add hermes dashboard --tls-cert and --tls-key flags that pass Uvicorn ssl_certfile / ssl_keyfile options for direct HTTPS serving.
• Add repeatable/comma-separated --allowed-host values so LAN/all-interface dashboard binds can fail closed for unlisted Host headers while preserving existing default behavior when no allowlist is configured.
• Update dashboard URL display/browser-open scheme and use wss:// for the dashboard PTY sidecar URL when TLS is enabled.
• Document the new flags in the CLI reference and web dashboard guide.

Verification

• scripts/run_tests.sh tests/hermes_cli/test_web_server.py tests/hermes_cli/test_web_server_host_header.py → 157 passed
• python -m py_compile hermes_cli/web_server.py hermes_cli/main.py
• ruff check hermes_cli/web_server.py hermes_cli/main.py tests/hermes_cli/test_web_server_host_header.py
• python -m hermes_cli.main dashboard --help | grep -E -- '--tls-cert|--tls-key|--allowed-host'
• git diff --check
• Manual smoke: generated a temporary self-signed cert, launched hermes dashboard --host 127.0.0.1 --port 19443 --no-open --tls-cert ... --tls-key ..., and verified curl --noproxy '*' --max-time 10 -k https://127.0.0.1:19443/api/status returned HTTP 200.
• Independent pre-commit code review: passed; no blocking security or logic concerns.

[teknium1]

Thanks for the direct-TLS and host-restriction work. The feature is still distinct from the related dashboard service work: #37119 explicitly says it excludes direct --tls-cert / --tls-key support.

Problems

• The new allowlist is enforced only by HTTP middleware at hermes_cli/web_server.py:263 on this PR. The PR’s WebSocket routes (/api/pty at line 3443, /api/ws at 3564, /api/pub at 3596, and /api/events at 3625) do not call _is_accepted_host; git grep finds no such WebSocket enforcement. The stated host restriction therefore does not cover dashboard chat upgrades.

Suggested changes

• Apply the normalized host allowlist to WebSocket Host and HTTP(S) Origin validation too, with allow/reject coverage for both protocols.
• Salvage against current main’s uvicorn.Config/uvicorn.Server startup at hermes_cli/web_server.py:17123, rather than the old uvicorn.run call. Preserve current sidecar host resolution (hermes_cli/web_server.py:14766) while adding TLS and WSS support.

Automated hermes-sweeper review.

[teknium1]

This applies the new allowlist only to HTTP middleware. The PR’s /api/pty, /api/ws, /api/pub, and /api/events WebSocket endpoints do not call _is_accepted_host, so a WebSocket upgrade bypasses the stated Host restriction. Please thread the same normalized allowlist through WebSocket Host and Origin validation and add coverage.