hermes - 💡(How to fix) Fix [bug]: hardcoded "***" session token

Bug Description

The dashboard injects window.HERMES_SESSION_TOKEN into the SPA's index.html, but since commit 63975aa75b ("fix: mobile chat in new layout", 2026-04-24), the token value is hardcoded as the literal string "***" instead of the actual ephemeral session token.

This causes all authenticated plugin API calls (e.g., /api/plugins/foo/, /api/plugins/kanban/) to fail with 401 Unauthorized, rendering plugin functionality unusable.

Steps to Reproduce

1. Start the dashboard: hermes dashboard
2. Open the web UI and navigate to the Wiki (or any other plugin)
3. Observe empty content / loading spinner
4. Browser devtools show {"detail":"Unauthorized"} on all /api/plugins/* requests

Root Cause

In hermes_cli/web_server.py, line ~3685 inside _serve_index():

Broken (current):

f'<script>window.HERMES_SESSION_TOKEN="***";'

Should be:

f'<script>window.HERMES_SESSION_TOKEN="{_SESSION_TOKEN}";'

The hardcoded "***" was likely accidentally committed during development/debugging.

Environment

• Hermes Agent: latest main (38+ commits since regression)
• Commit introducing bug: 63975aa75b (2026-04-24)
• File: hermes_cli/web_server.py:3685

Impact

• Document/content APIs return 401, page appears empty
• Kanban: Board operations fail
• Any custom plugins using fetchJSON() from dashboard SDK

Proposed Fix Replace the hardcoded "***" with {_SESSION_TOKEN} variable reference:

•        f'<script>window.__HERMES_SESSION_TOKEN__="***";'

•        f'<script>window.__HERMES_SESSION_TOKEN__="{_SESSION_TOKEN}";'