fix(web): allow WebSocket connections from remote clients when --insecure is used

[shaase-ctrl]

Problem

When using hermes dashboard --insecure --host 0.0.0.0, the HTTP page loads fine over Tailscale/remote connections, but the WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) still rejected non-loopback clients with code 4403 (Forbidden).

This caused "Session ended" errors in the Chat tab when accessing the dashboard remotely via Tailscale, even though --insecure was passed.

Root Cause

In hermes_cli/web_server.py:

• Line 3131: allow_public: bool = False is set when --insecure is used
• Lines 2391, 2499, 2532, 2562: WebSocket handlers check _LOOPBACK_HOSTS unconditionally
• allow_public was NOT stored in app.state for WebSocket handlers to check

Fix

1. Store allow_public in app.state in start_server() (line 3158)
2. Check app.state.allow_public before rejecting non-loopback clients in all 4 WebSocket handlers

Changes

• Added app.state.allow_public = allow_public in start_server()
• Updated WebSocket loopback check in pty_ws(), gateway_ws(), pub_ws(), events_ws() to skip the check when allow_public is True

Security Note

This fix only affects connections when --insecure is explicitly used. The default behavior (loopback-only) remains unchanged for security.

Testing

Tested locally with hermes dashboard --no-open --tui --host 0.0.0.0 --insecure over Tailscale - WebSocket Chat tab now works correctly from remote clients.