feat(hermes-agent): expose dashboard on LAN with basic auth

Bind the backend to 0.0.0.0:9119 in dashboard mode so the web UI is
reachable from the local network, open the port in the firewall, and
add dashboard username/password credentials to the mibook hermes-env
secret.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sux8hmeb2qadqPqbJ1zNzL

modules/environments/hermes-agent/default.nix

@@ -22,8 +22,20 @@ in
       settings.model.default = "anthropic/claude-sonnet-4-5";
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;
+
+      backend = {
+        # "dashboard" serves the browser admin panel, not just the API.
+        mode = "dashboard";
+        # Non-loopback bind opens the dashboard's auth gate — username/password
+        # comes from HERMES_DASHBOARD_BASIC_AUTH_* in hermes-env (see secrets.nix).
+        host = "0.0.0.0";
+        port = 9119;
+      };
     };
 
+    # NixOS default-deny firewall otherwise blocks inbound LAN connections.
+    networking.firewall.allowedTCPPorts = [ config.services.hermes-agent.backend.port ];
+
     # addToSystemPackages only puts `hermes` on $PATH; using it needs group
     # access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
     # this machine's one human user and already knows hermes-env's contents