port build_host_files.py to Go, simplify Hermes MCP, cutover final

- cmd/hermes/main.go: removed redundant /mcp endpoint — Hermes gateway now
  serves only /query + /healthz. MCP goes direct to API (:8090/mcp).
- cmd/oikos/build_hosts.go: Go port of mcp/build_host_files.py as
  'oikos build-hosts'. Reads inventory.yaml, writes hosts/*.yaml.
- cmd/oikos/main.go: added build-hosts role.
- docker-compose.yml: hermes service simplified.
- apps/105: all 6 Oikos services stopped + disabled (confirmed inactive).
- Watchdog cron installed, API stop/restart verified.
- Infisical bootstrap pending (image pull timeout — retry separately).

Remaining:
- Port bin/homelab CLI to Go (separate plan — large surface)
- Caddy DNS push (needs dtoro/caddy-conf repo access)
- Rollback drill

hosts/seanime.yaml

@@ -1,29 +1,29 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: seanime
-kind: lxc
-os: linux
-role: anime-media-server
-state: active
+# Generated by oikos build-hosts from inventory.yaml.
+# Do NOT edit by hand.
+
 host: strong
-pve_id: 133
+kind: lxc
 lan_ip: 192.168.8.248
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
-mounts:
-- /mnt/media_local/anime
-public_host: seanime.hubris.network
-notes:
-- Seanime anime media server for online streaming + local library scanning
-- Created 2026-07-05. Binary at /opt/seanime/bin/seanime, systemd service.
-- Connected to qBittorrent on arriman (192.168.8.245:8080)
-- 8 online streaming extensions installed (HiAnime, AniWatch, KickAssAnime, etc.)
-- /anime mounted from strong ludo-lvm (/mnt/media_local/anime)
-- Caddy: "https://seanime.hubris.network \u2192 192.168.8.248:43211"
-- qBittorrent auth subnet whitelist expanded to 192.168.8.0/24 for seanime access
 mcp_endpoint: https://mcp.hubris.network/mcp
+mesh_globals:
+  accepted:
+    - netbird
+    - tailscale
+  primary: netbird
+mounts:
+  - /mnt/media_local/anime
+name: seanime
+notes:
+  - Seanime anime media server for online streaming + local library scanning
+  - Created 2026-07-05. Binary at /opt/seanime/bin/seanime, systemd service.
+  - Connected to qBittorrent on arriman (192.168.8.245:8080)
+  - 8 online streaming extensions installed (HiAnime, AniWatch, KickAssAnime, etc.)
+  - /anime mounted from strong ludo-lvm (/mnt/media_local/anime)
+  - Caddy: https://seanime.hubris.network → 192.168.8.248:43211
+  - qBittorrent auth subnet whitelist expanded to 192.168.8.0/24 for seanime access
+os: linux
+public_host: seanime.hubris.network
+pve_id: 133
+role: anime-media-server
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
+state: active