fix: block public hermes browser UI

Caddyfile

@@ -360,22 +360,18 @@ homarr.ginnoir.com {
 	reverse_proxy homarr:7575
 }
 
-# Hermes Desktop remote backend. Browser UI is SSO-gated; API/WS paths
-# are passed through so Desktop clients can authenticate with the Hermes
-# dashboard session token instead of an Authentik browser cookie.
+# Hermes Desktop remote backend. Only API/WS is exposed for native
+# clients; the browser dashboard is blocked so its injected session token
+# is not leaked to the public web.
 hermes.ginnoir.com {
 	route {
-		import authentik_outpost
 		handle /api/* {
 			reverse_proxy 172.20.0.1:9119 {
 				header_up Host 172.20.0.1:9119
 			}
 		}
 		handle {
-			import authentik_forward_auth
-			reverse_proxy 172.20.0.1:9119 {
-				header_up Host 172.20.0.1:9119
-			}
+			respond "Hermes dashboard browser UI is disabled on this public hostname." 403
 		}
 	}
 }