port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

hosts/jellyfin.yaml

@@ -1,39 +1,38 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: jellyfin
-kind: lxc
-os: linux
-role: media-server
-state: active
+# Generated by oikos build-hosts from inventory.yaml.
+# Do NOT edit by hand.
+
 host: strong
-pve_id: 101
+kind: lxc
 lan_ip: 192.168.8.246
+mcp_endpoint: https://mcp.hubris.network/mcp
 mesh:
   tailscale:
     fqdn: jellyfin
 mesh_globals:
-  primary: netbird
   accepted:
-  - netbird
-  - tailscale
+    - netbird
+    - tailscale
+  primary: netbird
 mounts:
-- /mnt/media_local
-public_host: media.hubris.network
-runs:
-- jellyfin
-services_hosted:
-- name: jellyfin
-  url: https://media.hubris.network
-  backend: jellyfin
-  doc_page: knowledge/wiki/containers/101-jellyfin.md
-  risk_notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends
-    on GPU passthrough on strong
+  - /mnt/media_local
+name: jellyfin
 notes:
-- Jellyfin 10.11.11 with VAAPI hardware acceleration (Radeon 680M iGPU on strong)
-- 4 cores / 8 GiB RAM / 1 GiB swap
-- SSO-Auth plugin v4.0.0.4 with Authentik OIDC (no Caddy forward-auth gate)
-- GPU passed via dev0+dev1: /dev/dri/renderD128 + card0
-- Migrated from hubris to strong 2026-07-05 (Phase 2). Library on ludo-lvm.
-mcp_endpoint: https://mcp.hubris.network/mcp
+  - Jellyfin 10.11.11 with VAAPI hardware acceleration (Radeon 680M iGPU on strong)
+  - 4 cores / 8 GiB RAM / 1 GiB swap
+  - SSO-Auth plugin v4.0.0.4 with Authentik OIDC (no Caddy forward-auth gate)
+  - GPU passed via dev0+dev1: /dev/dri/renderD128 + card0
+  - Migrated from hubris to strong 2026-07-05 (Phase 2). Library on ludo-lvm.
+os: linux
+public_host: media.hubris.network
+pve_id: 101
+role: media-server
+runs:
+  - jellyfin
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+services_hosted:
+  - backend: jellyfin
+    doc_page: knowledge/wiki/containers/101-jellyfin.md
+    name: jellyfin
+    risk_notes: native Authentik OIDC via SSO-Auth plugin, no Caddy forward-auth gate; VAAPI transcode depends on GPU passthrough on strong
+    url: https://media.hubris.network
+state: active