feat(dashboard): add durable service support

cli-config.yaml.example

@@ -1144,6 +1144,12 @@ display:
 # (the ~/.hermes/.env file is reserved for API keys and secrets).
 #
 # dashboard:
+#   # Additional Host headers accepted only when the dashboard is bound to a
+#   # loopback address. Use this for Tailscale/headscale Serve, cloudflared, or
+#   # same-host reverse proxies that forward a public hostname to
+#   # http://127.0.0.1:9119 without using --insecure.
+#   allowed_hosts: []
+#
 #   oauth:
 #     client_id: ""    # agent:{instance_id}; Portal provisions this at deploy
 #     portal_url: ""   # blank → default https://portal.nousresearch.com

hermes_cli/config.py

@@ -1433,6 +1433,12 @@ def _ensure_hermes_home_managed(home: Path):
         # falls through to request reconstruction rather than breaking
         # the login flow.
         "public_url": "",
+        # Extra Host header names accepted by the dashboard DNS-rebinding
+        # guard when the server stays loopback-bound behind a trusted local
+        # proxy/tunnel such as Tailscale Serve or cloudflared. This is a
+        # list of exact hostnames; command-line ``--allowed-hosts`` and
+        # ``HERMES_DASHBOARD_ALLOWED_HOSTS`` can override it per launch.
+        "allowed_hosts": [],
     },
 
     # Privacy settings