feat: expose hermes dashboard backend

Caddyfile

@@ -360,6 +360,22 @@ homarr.ginnoir.com {
 	reverse_proxy homarr:7575
 }
 
+# Hermes Desktop remote backend. Browser UI is SSO-gated; API/WS paths
+# are passed through so Desktop clients can authenticate with the Hermes
+# dashboard session token instead of an Authentik browser cookie.
+hermes.ginnoir.com {
+	route {
+		import authentik_outpost
+		handle /api/* {
+			reverse_proxy 172.20.0.1:9119
+		}
+		handle {
+			import authentik_forward_auth
+			reverse_proxy 172.20.0.1:9119
+		}
+	}
+}
+
 backup.ginnoir.com {
 	route {
 		import authentik_outpost