fix: install piper-tts as root (venv is root-owned in base image)

The nousresearch/hermes-agent:latest image creates its venv
as root. Running 'uv pip install' as USER hermes fails with
Permission denied on the site-packages directory.

Fix: keep USER root while modifying the venv, then switch
back to USER hermes for runtime.

ai/Dockerfile

@@ -19,12 +19,8 @@ COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/
 
 WORKDIR /opt/hermes
 
-# ---------- Hermes venv ----------
-USER hermes
-
 # ---------- Piper TTS dans le venv existant ----------
-# Le venv existe déjà dans l'image de base (hermes-agent installé).
-# On ajoute simplement Piper et ses dépendences.
+# Le venv de l'image de base est root-owned, on doit installer en root aussi
 RUN . /opt/hermes/.venv/bin/activate && \
     uv pip install --no-cache-dir piper-tts sounddevice numpy
 
@@ -45,6 +41,9 @@ COPY patch_tts_tool.py /tmp/patch_tts_tool.py
 RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py
 
 # ---------- Runtime ----------
+# Retour à l'utilisateur non-root pour la sécurité
+USER hermes
+
 ENV HERMES_HOME=/opt/data
 ENV PATH="/opt/data/.local/bin:${PATH}"