feat: replace Open WebUI with native Hermes WebUI

Swap the generic Open WebUI frontend for the purpose-built
hermes-webui (nesquena) with full CLI parity:

- 3-panel layout: sessions, chat, workspace file browser
- Native session, cron, skills, memory, profile management
- Themes (dark/light/slate/solarized/monokai/nord/oled)
- Mobile responsive
- Sidecar container sharing the hermes-agent PVC
- Exposed via Tailscale on port 8787 (plain HTTP)

Access: http://hermes-webui.tail14a963.ts.net:8787

apps/base/customer1/hermes-agent/deployment.yaml

@@ -58,7 +58,7 @@ spec:
           - name: OPENAI_API_KEY
             value: "dummy"                                 # vLLM ignores this
 
-          # === API Server (for Open WebUI) ===
+          # === API Server (for external OpenAI-compatible clients) ===
           - name: API_SERVER_ENABLED
             value: "true"
           - name: API_SERVER_HOST
@@ -87,6 +87,42 @@ spec:
           limits:
             memory: 4Gi
             cpu: "2"
+      - name: hermes-webui
+        image: ghcr.io/nesquena/hermes-webui:latest
+        ports:
+        - containerPort: 8787
+        env:
+          - name: HERMES_HOME
+            value: "/home/hermeswebui/.hermes"
+          - name: HERMES_WEBUI_HOST
+            value: "0.0.0.0"
+          - name: HERMES_WEBUI_PORT
+            value: "8787"
+          - name: HERMES_WEBUI_STATE_DIR
+            value: "/home/hermeswebui/.hermes/webui"
+          - name: WANTED_UID
+            value: "1000"
+          - name: WANTED_GID
+            value: "1000"
+        volumeMounts:
+        - name: hermes-data
+          mountPath: /home/hermeswebui/.hermes
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: "100m"
+          limits:
+            memory: 512Mi
+            cpu: "500m"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
       volumes:
       - name: hermes-configmap
         configMap:

apps/base/customer1/hermes-agent/hermes-webui-service.yaml

@@ -2,18 +2,18 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: open-webui-service
+  name: hermes-webui-service
   namespace: customer1
   annotations:
     tailscale.com/expose: "true"
     tailscale.com/hostname: "hermes-webui"
     tailscale.com/tags: "tag:k8s-operator"
-    tailscale.com/ports: "http:8080"
+    tailscale.com/ports: "http:8787"
 spec:
   type: ClusterIP
   selector:
-    app: open-webui
+    app: hermes-agent
   ports:
-    - port: 8080
-      targetPort: 8080
+    - port: 8787
+      targetPort: 8787
       name: http

apps/base/customer1/hermes-agent/kustomization.yaml

@@ -7,6 +7,5 @@ resources:
   - rays-hermes-secret.yaml
   - rays-deployment.yaml
   - api-server-configmap.yaml
-  - open-webui-deployment.yaml
-  - open-webui-service.yaml
+  - hermes-webui-service.yaml
   - hermes-service.yaml

apps/base/customer1/hermes-agent/open-webui-deployment.yaml

@@ -1,65 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: open-webui
-  namespace: customer1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: open-webui
-  template:
-    metadata:
-      labels:
-        app: open-webui
-    spec:
-      containers:
-      - name: open-webui
-        image: ghcr.io/open-webui/open-webui:main
-        ports:
-        - containerPort: 8080
-        env:
-          # Connect to Hermes API Server
-          - name: OPENAI_API_BASE_URL
-            value: "http://hermes-agent-service.customer1.svc.cluster.local:8642/v1"
-          - name: OPENAI_API_KEY
-            valueFrom:
-              configMapKeyRef:
-                name: hermes-api-server
-                key: API_SERVER_KEY
-          # Open WebUI settings
-          - name: WEBUI_SECRET_KEY
-            valueFrom:
-              secretKeyRef:
-                name: hermes-secrets
-                key: TELEGRAM_BOT_TOKEN  # reuse as secret seed (any opaque string works)
-          - name: ENABLE_OPENAI_MODELS
-            value: "true"
-          - name: OPENAI_API_FORMAT
-            value: "hermes-agent"
-        resources:
-          requests:
-            memory: 1Gi
-            cpu: "250m"
-          limits:
-            memory: 2Gi
-            cpu: "500m"
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-          runAsNonRoot: true
-          runAsUser: 1000
-          seccompProfile:
-            type: RuntimeDefault
-        volumeMounts:
-          - name: open-webui-data
-            mountPath: /app/backend/data
-      volumes:
-        - name: open-webui-data
-          emptyDir: {}
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000