feat: provision private Hermes assistants for authenticated Hope accounts

livekit.yaml

@@ -1,11 +1,8 @@
+# Runtime deployments mount a root-only config generated from protected secrets.
+# No usable development key is committed. Fill both env and runtime YAML together.
 port: 7880
-
+bind_addresses: [127.0.0.1]
 rtc:
   tcp_port: 7881
   udp_port: 7882
-
-keys:
-  devkey: hopevoice-devsecret-2026-lan-only
-
-# Rooms are short-lived: each browser session gets a unique room name, so
-# the agent is dispatched at room creation. Default 300s cleanup is fine.
+keys: {}