What does this PR do?

The embedded TUI Chat tab (hermes dashboard --tui) rejects WebSocket connections from non-loopback IPs to prevent unauthorized remote access to the PTY. This is correct for localhost-only use, but blocks usage over Tailscale, VPNs, or LAN when the dashboard is intentionally bound to a non-loopback address with --insecure.

Add --insecure-chat which, when combined with --tui, skips the ws.client.host loopback check on all chat WebSocket endpoints:

• /api/pty
• /api/ws
• /api/pub
• /api/events

Update the web-dashboard docs to document the new flag, clarify that the Chat tab only appears when --tui is passed.

Related Issue

#15731

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• Add --insecure-chat flag parsing: hermes_cli/main.py
• Skip checks when --insecure-chat flag is passed: hermes_cli/web_server.py
• Document new flag, clarify that --tui flag in hermes dashboard command: website/docs/user-guide/features/web-dashboard.md

How to Test

1. run hermes dashboard --tui --host 0.0.0.0 --insecure --insecure-chat
2. go to chat tab in Hermes web dashboard (use non-loopback ip address of the host)
3. confirm you can chat with the agent

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Arch Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs