feat: Pheby platform adapter/plugin for Hermes (protocol v1)

Third-party Hermes platform plugin serving the Pheby WebSocket+HTTPS
protocol for the native Android client, behind Caddy:

- Platform adapter (BasePlatformAdapter subclass) registered via the
  documented plugin system (plugins.platforms pattern, kind: platform)
- Multiple conversations mapped to Hermes sessions (authoritative state)
- Streaming chat via GatewayStreamConsumer edit path (message.delta)
- Structured tool events (never fake tool text in chat), incl.
  post_tool_call hook relay with Hermes tool_call_ids
- Native approval + clarification round-trips via tools.approval /
  tools.clarify_gateway primitives
- Attachment delivery: adapter-owned copies, opaque IDs, persistent
  metadata, 7-day retention + safe cleanup, authenticated HTTPS download
- Model + reasoning-effort query/change via Hermes picker data and
  session/global overrides
- Shared-secret auth (constant-time, lockout), size limits, path-
  traversal-proof attachment resolution, minimal health endpoint
- Protocol v1 spec with JSON examples (docs/PROTOCOL.md)
- Install/config/Caddy/security docs + discovered Hermes limitations
- 37 passing tests (auth, conversations, protocol, attachments incl.
  expiry/traversal, tool events, approvals, clarifications, cancel,
  reconnect re-sync, live WS smoke tests) — gateway-free fakes

No Hermes core modifications required.

README.md

@@ -0,0 +1,17 @@
+# Root README redirects to the docs; kept short so the repo landing page
+# links straight to the important files.
+
+# Pheby — Hermes Platform Adapter/Plugin
+
+Private Hermes Agent platform plugin serving the Pheby WebSocket/HTTPS
+protocol for a native Android client.
+
+- **Start here:** [docs/README.md](docs/README.md) — architecture, install, Caddy, security, limitations
+- **Protocol spec:** [docs/PROTOCOL.md](docs/PROTOCOL.md) — every message type with JSON examples (Kotlin client reference)
+- **Original product spec:** [docs/spec-source/](docs/spec-source/)
+
+Install: copy `plugin/pheby/` into `~/.hermes/plugins/`, set `PHEBY_SECRET`
+in `~/.hermes/.env`, enable in config.yaml, restart the gateway. See
+[docs/README.md](docs/README.md).
+
+Tests: `.venv/bin/python -m pytest tests/ -o addopts= -q --asyncio-mode=auto`