fix(dashboard): allow trusted proxy hosts on loopback

[martinramos002-bot]

Summary

• add HERMES_DASHBOARD_ALLOWED_HOSTS for exact reverse-proxy Host values while the dashboard remains bound to loopback
• keep explicit non-loopback binds on their existing exact-match behavior
• reject malformed bracketed Host values instead of ignoring invalid suffixes
• document the environment variable with a neutral example

Security properties

• the allowlist applies only when bound_host is localhost, 127.0.0.1, or ::1
• unlisted hostnames remain rejected
• the setting does not change the bind interface
• external access still requires a reverse proxy that terminates TLS, enforces authentication and access controls, and does not expose the loopback upstream
• bracket notation is accepted only for IPv6, with an optional numeric port

Validation

• pytest -q tests/hermes_cli/test_web_server_host_header.py — 12 passed
• ruff check hermes_cli/web_server.py tests/hermes_cli/test_web_server_host_header.py — passed
• git diff --check — passed
• pre-publication sensitive-data scan — no private hostnames, paths, identifiers, or credentials

[martinramos002-bot]

Validation update: head 8d48538a145e91a10ab538e0d3e8e3b29d25a574 completed all 37 GitHub checks with 0 failures and 0 pending. Local Host-header suite: 12 passed; Ruff and git diff --check passed. The security review findings around non-loopback binds, malformed bracketed hosts, and reverse-proxy authentication guidance are addressed in this head.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[teknium1]

Thanks for the focused Host-header handling and documentation work.

This automated hermes-sweeper review is closing this as not_planned under the repository's env-var-for-config policy:

• The PR introduces HERMES_DASHBOARD_ALLOWED_HOSTS as a user-facing behavioral setting (hermes_cli/web_server.py, commit 8d48538a145e91a10ab538e0d3e8e3b29d25a574).
• AGENTS.md:102-106 requires non-secret settings to live in config.yaml, not a new HERMES_* environment variable.
• The underlying limitation is real on current main: loopback Host validation accepts only loopback names (hermes_cli/web_server.py:493-496).

Please re-scope any follow-up to a dashboard config.yaml setting and its normal configuration/setup integration, rather than an operator-facing environment variable.

---

Closed as not-planned per standing maintainer policy (env-var-for-config). This is a design-direction decision, not a code-quality judgment — see the Contribution Rubric in AGENTS.md for what the project is looking for. If you believe this policy was misapplied to your change, comment here and a maintainer will take a look.