Add --host and CORS config for hermes dashboard to enable Tailscale/VPN access

The hermes dashboard's CORS regex is hardcoded to localhost/127.0.0.1, so even with --host 0.0.0.0 the frontend loads but API calls are blocked, preventing remote access over VPNs like Tailscale; the issue requests configurable host/port and CORS origins.