Add Hermes operations management layer

.env.example

@@ -11,6 +11,7 @@ GEMINI_API_KEY=
 # canonical deployment secret name used by DigitalOcean and docs.
 GEMINI_VISION_MODEL=gemini-2.0-flash
 GEMINI_LIVE_MODEL=gemini-3.1-flash-tts-preview
+GEMINI_EMBEDDING_MODEL=gemini-embedding-001
 
 # --- GitHub (repo state + sync PR artifacts) ---
 GITHUB_TOKEN=
@@ -35,3 +36,18 @@ VITE_BACKEND_URL=http://localhost:8787
 # --- Deployment verification ---
 # Optional override when the deployed SPA and API use different origins.
 FRONTEND_URL=http://localhost:4173
+
+# --- Hermes operations watchdog ---
+PODMAN_PUBLIC_URL=https://165-22-129-249.sslip.io/
+PODMAN_PUBLIC_API_URL=https://165-22-129-249.sslip.io/api/pods
+PODMAN_PUBLIC_HEALTH_URL=https://165-22-129-249.sslip.io/health
+PODMAN_HERMES_REMEDIATE=1
+PODMAN_HERMES_STRICT=0
+PODMAN_HERMES_STATE_DIR=/var/log/podman
+# Optional Discord/Slack/generic webhook for failed watchdog runs.
+PODMAN_ALERT_WEBHOOK_URL=
+
+# --- Hermes git-sync deploy loop ---
+PODMAN_DEPLOY_REMOTE=origin
+PODMAN_DEPLOY_BRANCH=main
+PODMAN_DEPLOY_RESTART_SERVICES=podman-platform-api.service,podman-platform-agent.service,caddy.service