feat: add combined Hermes Workspace image with Swarm worker support

New directory ai/hermes-workspace/ with:
- Dockerfile (multi-stage): builds workspace web UI from source,
  overlays our Hermes fork, installs tmux for Swarm workers
- entrypoint-combined.sh: starts workspace UI, waits for gateway
- himalaya-ro.sh: read-only Himalaya wrapper (shared from hermes/)

Existing ai/hermes/ Dockerfile preserved unchanged as fallback.

compose.yml changes:
- Add HERMES_DASHBOARD=1 + healthcheck to hermes service
- Add hermes-workspace service using combined image
  (build context: ./hermes-workspace, SSH build)
  - Connects to hermes:8642 (gateway) + :9119 (dashboard)
  - Shares Hermes data volume for config/sessions/skills
  - Traefik on workspace.lazyworkhorse.net (port 3000)
  - Networks: ai_backend + ai_net

ai/compose.yml

@@ -52,6 +52,10 @@ services:
       - ROCR_VISIBLE_DEVICES=0,1
       - HSA_ENABLE_SDMA=0
       - TZ=America/Montreal
+      # Hermes Workspace dashboard (port 9119) — enables multi-agent web UI
+      - HERMES_DASHBOARD=1
+      - HERMES_DASHBOARD_HOST=0.0.0.0
+      - HERMES_DASHBOARD_PORT=9119
     volumes:
       - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
       # Syncthing-shared org files — read-only view of user's agenda
@@ -66,6 +70,12 @@ services:
       - "26"
     networks:
       - ai_backend
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8642/health && curl -fsS http://localhost:9119/api/status || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
 
   syncthing:
     image: syncthing/syncthing:latest
@@ -129,6 +139,46 @@ services:
       - "303"
       - "26"
 
+  # ── Hermes Workspace (combined image) ────────────────────────
+  # Web UI + Swarm worker support. Uses custom combined image with
+  # our Hermes fork + workspace web UI + tmux for Swarm workers.
+  hermes-workspace:
+    build:
+      context: ./hermes-workspace
+      ssh:
+        - default
+    container_name: hermes-workspace
+    restart: unless-stopped
+    depends_on:
+      hermes:
+        condition: service_healthy
+    environment:
+      HERMES_API_URL: http://hermes:8642
+      HERMES_DASHBOARD_URL: http://hermes:9119
+      HERMES_API_TOKEN: hermes_local_key
+      HERMES_PASSWORD: ${HERMES_WORKSPACE_PASSWORD:?must be set}
+      COOKIE_SECURE: "1"
+    volumes:
+      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    networks:
+      - ai_backend
+      - ai_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=ai_net"
+
+      - "traefik.http.routers.workspace-http.rule=Host(`workspace.lazyworkhorse.net`)"
+      - "traefik.http.routers.workspace-http.entrypoints=web"
+      - "traefik.http.routers.workspace-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.workspace-https.rule=Host(`workspace.lazyworkhorse.net`)"
+      - "traefik.http.routers.workspace-https.entrypoints=websecure"
+      - "traefik.http.routers.workspace-https.tls=true"
+      - "traefik.http.routers.workspace-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.workspace.loadbalancer.server.port=3000"
+# ─────────────────────────────────────────────────────────────
+
 networks:
   ai_net:
     external: true