chore: bootstrap hermes-ui skeleton from 0.6.29 snapshot

Import the client, server, skills, tests, and build scripts as the starting
point for the rebuild, then trim the surfaces this project does not ship:
Electron desktop packaging, the marketing website, and the ESP32 firmware
tree. CI keeps the web build, e2e, lockfile, release, and Docker workflows.

Rename the package and CLI entry points to hermes-ui, drop the prepare hook so
npm ci no longer triggers a build, and drop the removed tsconfig and nodemon
references. Rewrite AGENTS.md, ARCHITECTURE.md, DEVELOPMENT.md, and the READMEs
so the documented package map and hard rules match this repository.

reference_code/ is ignored: it is a read-only snapshot, not an input to the build.

tests/server/login-limiter.test.ts

@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+async function loadLimiter() {
+  vi.resetModules()
+  vi.doMock('fs/promises', () => ({
+    readFile: vi.fn().mockRejectedValue(new Error('ENOENT')),
+    writeFile: vi.fn(),
+    mkdir: vi.fn(),
+  }))
+  vi.doMock('fs', () => ({ writeFileSync: vi.fn() }))
+  vi.doMock('../../packages/server/src/config', () => ({
+    config: { appHome: '/tmp/hermes-web-ui-test' },
+  }))
+  return import('../../packages/server/src/services/login-limiter')
+}
+
+describe('login limiter', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-05-24T00:00:00Z'))
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.doUnmock('fs/promises')
+    vi.doUnmock('fs')
+    vi.doUnmock('../../packages/server/src/config')
+    vi.resetModules()
+  })
+
+  it('locks password login on the tenth failed attempt from the same IP', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.10'
+
+    for (let i = 0; i < 9; i++) {
+      expect(limiter.checkPassword(ip)).toEqual({ allowed: true })
+      limiter.recordPasswordFailure(ip)
+    }
+
+    expect(limiter.checkPassword(ip)).toEqual({ allowed: true })
+    limiter.recordPasswordFailure(ip)
+
+    expect(limiter.checkPassword(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.getLockedIps()).toEqual([
+      expect.objectContaining({ ip, type: 'password', failures: 10 }),
+    ])
+  })
+
+  it('locks token auth on the tenth failed attempt from the same IP', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.20'
+
+    for (let i = 0; i < 9; i++) {
+      expect(limiter.checkToken(ip)).toEqual({ allowed: true })
+      limiter.recordTokenFailure(ip)
+    }
+
+    expect(limiter.checkToken(ip)).toEqual({ allowed: true })
+    limiter.recordTokenFailure(ip)
+
+    expect(limiter.checkToken(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.getLockedIps()).toEqual([
+      expect.objectContaining({ ip, type: 'token', failures: 10 }),
+    ])
+  })
+
+  it('allows password login to recover an IP locked only by stale token failures', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.21'
+
+    for (let i = 0; i < 10; i++) {
+      expect(limiter.checkToken(ip)).toEqual({ allowed: true })
+      limiter.recordTokenFailure(ip)
+    }
+
+    expect(limiter.checkToken(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.getLockedIps()).toEqual([
+      expect.objectContaining({ ip, type: 'token', failures: 10 }),
+    ])
+
+    expect(limiter.checkPassword(ip)).toEqual({ allowed: true })
+    limiter.recordPasswordSuccess(ip)
+
+    const { writeFileSync } = await import('fs')
+    expect(writeFileSync).toHaveBeenCalled()
+    const persistedState = JSON.parse((writeFileSync as unknown as ReturnType<typeof vi.fn>).mock.calls.at(-1)?.[1] as string)
+    expect(persistedState.tokenIpMap).toEqual({})
+
+    expect(limiter.getLockedIps()).toEqual([])
+    expect(limiter.checkToken(ip)).toEqual({ allowed: true })
+  })
+
+  it('keeps password locks authoritative for protected API and pairing attempts', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.22'
+
+    for (let i = 0; i < 10; i++) {
+      expect(limiter.checkPassword(ip)).toEqual({ allowed: true })
+      limiter.recordPasswordFailure(ip)
+    }
+
+    expect(limiter.checkPassword(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.checkToken(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: false, status: 429 })
+  })
+
+  it('locks pairing attempts and clears stale failure records after the window', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.30'
+
+    limiter.recordPairingFailure(ip)
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: true })
+
+    vi.advanceTimersByTime(16 * 60_000)
+
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: true })
+    expect(limiter.getLockedIps()).toEqual([])
+  })
+
+  it('locks pairing attempts on the tenth failed attempt from the same IP', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.40'
+
+    for (let i = 0; i < 9; i++) {
+      expect(limiter.checkPairing(ip)).toEqual({ allowed: true })
+      limiter.recordPairingFailure(ip)
+    }
+
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: true })
+    limiter.recordPairingFailure(ip)
+
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.getLockedIps()).toEqual([
+      expect.objectContaining({ ip, type: 'pairing', failures: 10 }),
+    ])
+  })
+
+  it('allows password login to recover an IP locked only by pairing failures', async () => {
+    const limiter = await loadLimiter()
+    const ip = '192.0.2.41'
+
+    for (let i = 0; i < 10; i++) {
+      expect(limiter.checkPairing(ip)).toEqual({ allowed: true })
+      limiter.recordPairingFailure(ip)
+    }
+
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: false, status: 429 })
+    expect(limiter.checkPassword(ip)).toEqual({ allowed: true })
+    limiter.recordPasswordSuccess(ip)
+
+    expect(limiter.getLockedIps()).toEqual([])
+    expect(limiter.checkPairing(ip)).toEqual({ allowed: true })
+  })
+})