feat: provision private Hermes assistants for authenticated Hope accounts

.env.example

@@ -1,45 +1,22 @@
-# Azure Speech (required)
-AZURE_SPEECH_KEY=your-azure-speech-key
+# Copy to .env; NEVER commit actual credentials.
+AZURE_SPEECH_KEY=
 AZURE_SPEECH_REGION=eastus
-
-# Default TTS voice (Azure Dragon HD Omni; supports inline delivery markers)
 AZURE_TTS_VOICE=en-US-Ava:DragonHDOmniLatestNeural
-
-# LLM (OpenWebUI on xNAS, OpenAI-compatible; also serves the local llama.cpp
-# models. The model can be switched live from the web UI settings sheet.)
-LLM_BASE_URL=http://192.168.86.2:3005/api
-LLM_MODEL=qwen2.5-vl-3b
-LLM_API_KEY=sk-your-openwebui-api-key
-
-# LiveKit (generated in livekit.yaml, referenced here for the agent)
-LIVEKIT_URL=http://localhost:7880
-LIVEKIT_API_KEY=devkey
-LIVEKIT_API_SECRET=hopevoice-devsecret-2026-lan-only
-
-# Web UI port (9178 avoids the existing Unraid service on 8090)
 WEB_PORT=9178
 
-# ── Web access (MCP tools: web_search + web_scrape) ────────────────────────
-# Backed by the self-hosted Firecrawl stack on xNAS.
-WEB_MCP_ENABLED=true
-FIRECRAWL_BASE=http://192.168.86.2:3002
-# Only needed if your Firecrawl instance requires an API key
-# FIRECRAWL_API_KEY=
+# Must match the private LiveKit server configuration.
+LIVEKIT_API_KEY=
+LIVEKIT_API_SECRET=
+LIVEKIT_CONFIG_PATH=/mnt/user/appdata/hope-voice/livekit.yaml
 
-# Per-user memory profiles and Bearer tokens live in config/users.json.
-VOICE_DEFAULT_USER=shane
-
-# ── Hope Music (separate LAN service) ───────────────────────────────────────
-# The voice agent keeps the music MCP tools, but the library, downloads,
-# streaming, and browser player live in the hope-media-music product.
-MUSIC_BASE_URL=http://192.168.86.2:8094
-# Stable player scope shared with the standalone Hope Music page. Do not use
-# the ephemeral LiveKit room name minted for each conversation.
-MUSIC_ROOM=voice-room
-# Player reports are refreshed every few seconds. Older "playing" reports are
-# treated as stale so a closed player cannot leave Hope's mic disabled.
-MUSIC_REPORT_TTL=30
-
-# Extra MCP servers (optional). JSON list of {url, transport} objects.
-# transport: "sse" | "streamable_http" | omit for auto-detect
-# EXTRA_MCP_SERVERS=[{"url":"http://192.168.86.2:3001/mcp","transport":"streamable_http"}]
+# Trusted account control-plane secret (generate at least 32 random bytes).
+CONTROL_SERVICE_SECRET=
+CONTROL_ADMIN_USERNAME=admin
+CONTROL_ADMIN_PASSWORD=
+CONTROL_ALLOWED_ORIGINS=https://192.168.86.2:9178,https://localhost:9178
+# Bind source must be the same absolute path inside control and on Unraid.
+HOPE_HERMES_DATA_DIR=/mnt/user/appdata/hope-voice/hermes
+HERMES_IMAGE=nousresearch/hermes-agent@sha256:d4da4a40cd7a28aba983775d9fd31d94cbf153eeb0cb9e844d6d0f612b7c24db
+HERMES_UPSTREAM_URL=http://192.168.86.5:2099/v1
+HERMES_UPSTREAM_MODEL=auto
+HERMES_UPSTREAM_API_KEY=