fix(dashboard): validate WebSocket Host and Origin (salvage #30221)

[teknium1]

Salvage of #30221 by @Hinotoi-agent onto current main. CI on the original was failing on a 95-commit-stale branch (kanban_notify flakes + teardown noise); fresh rebase against current main: 199 web_server/dashboard tests pass.

Summary

FastAPI HTTP middleware doesn't run for WebSocket routes, so the existing GHSA-ppp5-vxwm-4cf7 Host-header DNS-rebinding guard was only applied to HTTP. WS upgrades had to be hit too — otherwise a victim browser on the dashboard host could be reached via DNS rebinding + a malicious site, opening ws:// to the loopback dashboard with attacker-controlled Origin. With #30741 (loopback-only) just merged, this is the last common-case DNS rebinding gap on the dashboard surface.

Changes

• hermes_cli/web_server.py: new _ws_host_origin_is_allowed() + _ws_request_is_allowed() reusing the existing _is_accepted_host() helper. Applied to all 4 WS endpoints: /api/pty, /api/ws, /api/pub, /api/events. Host always checked; Origin checked only when present (so non-browser WS clients keep working).
• tests/hermes_cli/test_web_server_host_header.py: 4 new WebSocket cases — rebinding Host rejected, rebinding Origin rejected, loopback Host+Origin accepted, missing-Origin permissive.
• tests/hermes_cli/test_web_server.py: existing WS sidecar test updated to send loopback Host+Origin headers (otherwise the new guard rejects the bare TestClient handshake).

Test plan

pytest tests/hermes_cli/test_web_server.py tests/hermes_cli/test_web_server_host_header.py  # 156 passed
pytest tests/hermes_cli/ -k 'web_server or dashboard'                                       # 199 passed

Co-authored-by: Hinotoi-agent paperlantern.agent@gmail.com

Closes #30221

[github-actions]

🔎 Lint report: hermes/hermes-f9dd4507 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9084 on HEAD, 9079 on base (🆕 +5)

🆕 New issues (1):

Rule	Count
unresolved-import	1

First entries

tests/hermes_cli/test_web_server_host_header.py:179: [unresolved-import] unresolved-import: Cannot resolve imported module `starlette.websockets`

✅ Fixed issues: none

Unchanged: 4835 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.