feat: Pheby platform adapter/plugin for Hermes (protocol v1)

Third-party Hermes platform plugin serving the Pheby WebSocket+HTTPS
protocol for the native Android client, behind Caddy:

- Platform adapter (BasePlatformAdapter subclass) registered via the
  documented plugin system (plugins.platforms pattern, kind: platform)
- Multiple conversations mapped to Hermes sessions (authoritative state)
- Streaming chat via GatewayStreamConsumer edit path (message.delta)
- Structured tool events (never fake tool text in chat), incl.
  post_tool_call hook relay with Hermes tool_call_ids
- Native approval + clarification round-trips via tools.approval /
  tools.clarify_gateway primitives
- Attachment delivery: adapter-owned copies, opaque IDs, persistent
  metadata, 7-day retention + safe cleanup, authenticated HTTPS download
- Model + reasoning-effort query/change via Hermes picker data and
  session/global overrides
- Shared-secret auth (constant-time, lockout), size limits, path-
  traversal-proof attachment resolution, minimal health endpoint
- Protocol v1 spec with JSON examples (docs/PROTOCOL.md)
- Install/config/Caddy/security docs + discovered Hermes limitations
- 37 passing tests (auth, conversations, protocol, attachments incl.
  expiry/traversal, tool events, approvals, clarifications, cancel,
  reconnect re-sync, live WS smoke tests) — gateway-free fakes

No Hermes core modifications required.

tests/conftest.py

@@ -0,0 +1,28 @@
+"""Pytest fixtures: redirect HERMES_HOME to a temp dir and fix sys.path."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+_PLUGIN_DIR = Path(__file__).resolve().parent.parent / "plugin"
+_HERMES_SRC = os.environ.get("PHEBY_HERMES_SRC", "/opt/hermes")
+for _p in (str(_PLUGIN_DIR), _HERMES_SRC):
+    if _p not in sys.path:
+        sys.path.insert(0, _p)
+
+
+@pytest.fixture(autouse=True)
+def _isolated_hermes_home(tmp_path, monkeypatch):
+    """Point HERMES_HOME at a per-test temp dir (Hermes tests' convention)."""
+    home = tmp_path / "hermes-home"
+    home.mkdir(parents=True, exist_ok=True)
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    # Also neutralize any ambient PHEBY config so tests are deterministic.
+    monkeypatch.delenv("PHEBY_SECRET", raising=False)
+    monkeypatch.delenv("PHEBY_BIND_HOST", raising=False)
+    monkeypatch.delenv("PHEBY_PORT", raising=False)
+    yield str(home)