chore: clean up WireGuard from Hermes Dockerfile, keep custom build

ai/Dockerfile

@@ -21,8 +21,7 @@ RUN apt-get update && \
         texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
         qemu-user-static binfmt-support qemu-user-binfmt \
         emacs-nox \
-        libportaudio2 \
-        wireguard-tools openresolv && \
+        libportaudio2 && \
     rm -rf /var/lib/apt/lists/*
 
 # Non-root user for runtime; UID can be overridden via HERMES_UID at runtime

ai/compose.yml

@@ -29,8 +29,6 @@ services:
     build: ./
     container_name: hermes
     restart: always
-    cap_add:
-      - NET_ADMIN
     # Gateway run enables the internal API server on port 8642
     command: gateway run
     environment: