feat: harden dashboard public access

[andupetcu]

Summary

• Adds hardened public dashboard mode with cookie auth, CSRF protection, host allow-listing, and security headers.
• Updates the web UI to support setup/login/logout without exposing the legacy session token.
• Adds regression tests and network access runbook.

Verification

• python -m pytest tests/hermes_cli/test_production_exposure_hardening.py tests/hermes_cli/test_web_server_host_header.py tests/hermes_cli/test_dashboard_lifecycle_flags.py -q -o addopts=
• python -m pytest tests/hermes_cli/test_web_server.py tests/hermes_cli/test_web_server_cron_profiles.py tests/hermes_cli/test_production_exposure_hardening.py -q -o addopts=
• npm run build
• Manual smoke: public setup/login, protected config auth, CSRF-enforced logout, no legacy SPA token injection

Note: a full python -m pytest tests/ -q -o addopts= run was attempted locally but the existing full-suite run exhausted macOS file descriptors (OSError: [Errno 24] Too many open files) outside this change scope.

[teknium1]

Thanks for the substantial work here — first-admin setup flow, CSRF, Host allow-listing, security headers, and the docs runbook are all well-thought-out.

Closing because we're going to design and implement dashboard public-mode auth ourselves — we want this surface to be a first-party architectural decision rather than a feature add via PR. That includes the password store layout, session/CSRF token format, CLI flag shape, and how it interacts with the recently-landed loopback-by-default (#30741) and WebSocket Host/Origin (#30221) guards. Your implementation is a useful reference, and several of the concepts you laid out (HttpOnly signed-session cookie, Host allow-listing for non-loopback binds, CSRF on mutating routes, no SPA token injection in public mode) are going to inform the final design.

Not a quality rejection — credit will be in the PR description and changelog when we ship our own version. Appreciate the effort.