feat: web UI dashboard for managing Hermes Agent

[teknium1]

Summary

Salvage of PR #8204 by @kshitijk4poor (originally from PR #7621, itself a salvage of PR #1813 by @austinpickett) onto current main.

Adds an embedded web UI dashboard accessible via hermes web:

• Status page: agent version, active sessions, gateway status, connected platforms
• Config editor: schema-driven form with tabbed categories, import/export, reset to defaults
• API Keys page: set, clear, and view redacted values with category grouping
• Sessions, Skills, Cron, Logs, Analytics pages

Backend

• hermes_cli/web_server.py — FastAPI server with REST endpoints (/api/status, /api/sessions, /api/config, /api/env)
• hermes_cli/config.py — Added reload_env() utility (with proper deleted-var cleanup)
• hermes_cli/main.py — Added hermes web subcommand (--port, --host, --no-open), extracted _build_web_ui() helper
• cli.py / commands.py — Added /reload slash command for hot-reloading .env
• pyproject.toml — Added [web] optional dependency extra (fastapi + uvicorn)
• Both update paths (git + zip) now build the web frontend automatically when npm is available

Frontend

• Vite + React + TypeScript + Tailwind v4 SPA in web/
• shadcn/ui-style components with Nous design language
• Auto-refresh status page, toast notifications, masked password inputs

Security

• Path traversal guard (resolve().is_relative_to()) on SPA file serving
• CORS localhost-only via allow_origin_regex
• Generic error messages (no internal leak), SessionDB handles closed properly

Changes vs original PR #8204

Dropped all stale-branch regressions:

• Kept /debug command, MATRIX_RECOVERY_KEY, gateway_notify_interval, api_mode for custom providers, exit-code-before-restart logic, URL validation, profile create guidance
• Dropped planning docs (docs/plans/, optimizations.md, research/)
• Dropped skill file modifications and unrelated skills_hub.py changes

Test plan

• python -m pytest tests/hermes_cli/test_web_server.py -o 'addopts=' -q → 47 passed
• python -m pytest tests/hermes_cli/ -o 'addopts=' -q → 1864 passed (10 pre-existing failures in auth/env tests, unrelated)

Attribution

Original work by @austinpickett (PR #1813), salvaged by @kshitijk4poor (PR #7621 → #8204).

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

6314:+  while ((match = pattern.exec(text)) !== null) {

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

6411:+  while ((match = pattern.exec(text)) !== null) {

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

6409:+  while ((match = pattern.exec(text)) !== null) {

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

6451:+  while ((match = pattern.exec(text)) !== null) {
9427:+  while ((match = regex.exec(snippet)) !== null) {

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.