hermes: add supervised dashboard-cathou service (:9120, own identity). Second s6 service reusing the main dashboard machinery, mounted read-only; env injected in compose. Runs the command directly to dodge the with-contenv env reset that would collapse it to the main service identity.

ai/s6/dashboard-cathou/dependencies.d/base

@@ -0,0 +1 @@
+base

ai/s6/dashboard-cathou/finish

@@ -0,0 +1,4 @@
+#!/command/with-contenv sh
+# Always restart on exit (exit != 125). Crash-loop with a bad auth
+# config is the intended fail-closed signal.
+exit 0

ai/s6/dashboard-cathou/run

@@ -0,0 +1,17 @@
+#!/command/with-contenv sh
+# Personal dashboard serve (:9120) for cathou — same machinery as the
+# main dashboard service, but runs the command directly so its OWN
+# with-contenv shebang can't wipe our env (a second with-contenv reset
+# would drop the port + auth variables). Supervised by s6: restarts on crash.
+export HERMES_DASHBOARD_PORT=9120
+export HERMES_DASHBOARD_BASIC_AUTH_USERNAME=cathou
+export HERMES_DASHBOARD_BASIC_AUTH_PASSWORD="${CATHOU_SERVE_PASSWORD:-}"
+export HERMES_DASHBOARD_BASIC_AUTH_SECRET="${CATHOU_SERVE_SECRET:-}"
+export HOME=/opt/data
+cd /opt/data
+# shellcheck disable=SC1091
+. /opt/hermes/.venv/bin/activate
+# Fail-closed: missing password => provider won't register => serve fails
+# => s6 crash-loop surfaces it, never a silent unauthenticated bind.
+[ "$(id -u)" = 0 ] || exec hermes dashboard --host 0.0.0.0 --port 9120 --no-open
+exec s6-setuidgid hermes hermes dashboard --host 0.0.0.0 --port 9120 --no-open

ai/s6/dashboard-cathou/type

@@ -0,0 +1 @@
+longrun