feat: provision private Hermes assistants for authenticated Hope accounts

control.Dockerfile

@@ -0,0 +1,7 @@
+FROM python:3.12-slim-bookworm
+WORKDIR /app
+RUN pip install --no-cache-dir fastapi==0.142.2 httpx==0.28.1 uvicorn==0.54.0
+COPY control /app/control
+ENV PYTHONUNBUFFERED=1
+# Dedicated trusted management process: never share this socket with speech/Hermes.
+CMD ["python", "-m", "control"]