feat: Add Hermes Agent service

- New service in services/hermes/ with docker-compose.yml
- Uses nousresearch/hermes-agent:latest on paperclip-net
- Hermes reachable internally at http://hermes:8642 (API) and :9119 (dashboard)
- Public dashboard at hermes.orfel.de via Caddy
- .env.age encrypted with age for OPENROUTER_API_KEY
- README updated with Hermes architecture and PaperClip integration guide

services/hermes/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  hermes:
+    image: nousresearch/hermes-agent:latest
+    container_name: hermes
+    environment:
+      OPENROUTER_API_KEY: "${OPENROUTER_API_KEY}"
+    volumes:
+      - /opt/PaperClip-Data/hermes:/opt/data
+    networks:
+      - paperclip-net
+    restart: unless-stopped
+
+networks:
+  paperclip-net:
+    external: true