feat: add Hermes WebUI provisioning and English Dragon HD Omni voices

QUALIFICATION.md

@@ -15,6 +15,77 @@ credentials; requires manual iOS profile installation + full trust for WSS. Priv
 key URL remains404. Do not expose the entire cert directory. Initial container-copy
 profile disappeared during intervening deployment; persistent alias fixed it.
 
+## Per-account Hermes WebUI — live receipt 2026-10-02
+
+Installed pinned nesquena/hermes-webui `62e4d7b9e2560f9d49c0c29c2dc1414fbd4e2d12`
+inside both existing account containers using `hope-hermes-webui:62e4d7b`
+(image `sha256:9324675849a485d4f6b851045d065bd4ebf5c3b7b5d85c0b112e9f91e64571b3`).
+WebUI and the existing pinned Hermes gateway run as supervised peer processes.
+Control image `sha256:e24aaa314d2e261da3693fd14ebe14dfbd62dbcf2d046e9181399ac033b3c7a8`
+is running as `hope-voice-control:webui-upgrade`, also tagged `latest`.
+
+- Admin WebUI: `https://192.168.86.2:30000`.
+- Shane WebUI: `https://192.168.86.2:30001`.
+- Gateway APIs remain private on `127.0.0.1:20000` and `:20001`.
+- Distinct persistent random browser passwords, cookie names, WebUI state and
+  self-signed TLS certificates per account. Passwords are stored root-only under
+  `<runtime-root>/hermes/<full-account-id>/webui-password`, not Hope login passwords.
+- Protected runtime environment now enables WebUI and its packaged image for new
+  accounts, using LAN port allocation range `30000-30999`. CI builds the image.
+
+Verified from a separate LAN client: both HTTPS login pages returned200; no host
+firewall/router changes were necessary. Authenticated checks on each WebUI:
+health200, anonymous sessions401, password login200, authenticated sessions200.
+Each authenticated WebUI created a qualification session, submitted a real
+Gateway-backed turn and received an SSE stream containing `WEBUI_LAN_OK`.
+Both pinned gateways advertise runs, SSE, cancellation and approval capabilities.
+Full browser approval/cancellation workflow has not been independently qualified.
+Offline regression:81 passed. Voice remains healthy, control healthOK, accounts
+ready. No public-internet port forwarding or exposure configured.
+
+Persistent state and runtime env backed up under
+`/mnt/user/appdata/hope-voice/rollback/webui-20261002T173832Z` with protected inspect
+receipts; previous control retained stopped as `hope-control-pre-webui-20261002T173832Z`.
+Homes/workspaces and private gateway credentials retained. Source is still
+local/unpushed; an older CI checkout could undo this change. Self-signed browser
+certificate trust must be accepted/installed by clients. Different ports on the
+same IP are not a browser cookie isolation boundary; distinct account DNS names
+provide stronger isolation. Runtime instructions in `control/README.md`.
+
+## Host-network LAN migration — live receipt 2026-10-02
+
+Deployed control image `sha256:cc5cc7dd470e590ffc0c0b8084f4b2c2496074d42028695dde23644e2d4a576f`
+as `hope-voice-control:lan-upgrade`, also tagged `hope-voice-control:latest`.
+Control startup migrated both existing accounts without changing account names,
+credentials or persistent home/workspace mount paths:
+
+- `hope-hermes-admin-69101358`: host networking, ready, API `127.0.0.1:20000`.
+- `hope-hermes-shane-fc44d140`: host networking, ready, API `127.0.0.1:20001`.
+
+Authenticated Hermes readiness passed for both. API key SHA256 digests matched
+pre-migration backup records. Actual `/proc/net/tcp` listeners were loopback-only.
+From inside **each** container, TCP connections succeeded to `192.168.86.5:2099`
+(model), `192.168.86.2:9178` (Hope UI), and `192.168.86.2:8094` (Hope Music).
+These are reachability checks, not a new end-to-end conversation qualification.
+Owned legacy networks were removed. Voice remained healthy and public UI HTTP200;
+control `/health` returned OK. Unrelated containers were not redeployed.
+
+Before replacement, control and both Hermes containers were stopped and account
+DB/Hermes persistent state archived root-only under
+`/mnt/user/appdata/hope-voice/rollback/lan-20261002T172231Z`, alongside protected
+Docker inspection receipts. Stale Unix sockets were intentionally skipped by tar.
+Original stopped control retained as `hope-control-pre-lan-20261002T172231Z`.
+Existing NAS source checkout was not overwritten; clean control source staged
+separately. Source changes are still local/unpushed: future CI deployments from
+older source could regress this networking change until the update is committed
+and deployed through the repository pipeline.
+
+Runtime and migration instructions are in `control/README.md`. Host networking
+removes per-user network namespace isolation; the Hermes API is loopback-only,
+but arbitrary terminal tools can expose their own ports unless a separate host
+ingress policy prevents it. Historical deployment receipts below predate this
+migration.
+
 ## Deployment
 
 Target: Unraid `192.168.86.2`, public UI `https://192.168.86.2:9178`.