[codex] Fix dashboard Host allowlist for loopback reverse proxies

[iseff]

Summary

• add an explicit loopback-only dashboard Host allowlist for trusted reverse proxies such as Tailscale Serve
• wire hermes dashboard --allowed-host plus HERMES_DASHBOARD_ALLOWED_HOSTS and dashboard.allowed_hosts
• extend the Host-header regression tests for HTTP, WebSocket, and config/env resolution

Root cause

The dashboard's DNS-rebinding guard correctly rejected non-loopback Host headers when the backend was bound to 127.0.0.1, but that also blocked legitimate requests arriving through a trusted loopback reverse proxy or Tailscale Serve MagicDNS hostname.

What changed

• normalize Host / Origin / allowlist matching case-insensitively while stripping ports and handling IPv6 bracket notation
• keep the default loopback DNS-rebinding protection intact and only consult the operator allowlist for loopback binds
• leave explicit non-loopback and 0.0.0.0 behavior unchanged
• document the safe path in CLI help and config comments without broadening --insecure

Validation

• scripts/run_tests.sh tests/hermes_cli/test_web_server_host_header.py tests/hermes_cli/test_dashboard_auth_gate.py tests/hermes_cli/test_dashboard_auth_ws_auth.py
• ruff check hermes_cli/web_server.py hermes_cli/main.py hermes_cli/config.py tests/hermes_cli/test_web_server_host_header.py tests/hermes_cli/test_dashboard_auth_gate.py