Phase 002: rebrand to hermes-ui and consolidate i18n to zh/en

Removes the ekko / hermes-web-ui branding from the whole tree and drops
eight locale files, so the project presents one name and one language pair.

Data compatibility is deliberate, not accidental: DB filenames, the JWT
audience, and skill manifest ownership all still recognise their pre-rename
values so existing deployments under ~/.hermes-web-ui keep working without a
re-login or a re-injection.

scripts/harness-check.mjs now scans for the legacy strings and fails the
build on any new occurrence, with an explicit allow-list (and reasons) for
the compatibility paths that must keep them.

.github/workflows/docker-publish.yml

@@ -41,9 +41,9 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:latest
-            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:${{ github.sha }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:${{ github.event.release.tag_name || github.ref_name }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-ui:latest
+            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-ui:${{ github.sha }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-ui:${{ github.event.release.tag_name || github.ref_name }}
 
   keep-release-out-of-latest:
     name: Keep release out of GitHub latest

.github/workflows/webui-release.yml

@@ -51,14 +51,14 @@ jobs:
         run: |
           set -euo pipefail
           version="$(node -p "require('./package.json').version")"
-          asset="hermes-web-ui-${version}.tar.gz"
-          manifest="hermes-web-ui-${version}.json"
-          mkdir -p release/webui /tmp/hermes-web-ui-package/webui
+          asset="hermes-ui-${version}.tar.gz"
+          manifest="hermes-ui-${version}.json"
+          mkdir -p release/webui /tmp/hermes-ui-package/webui
 
-          cp package.json package-lock.json /tmp/hermes-web-ui-package/webui/
-          cp -R bin dist node_modules /tmp/hermes-web-ui-package/webui/
+          cp package.json package-lock.json /tmp/hermes-ui-package/webui/
+          cp -R bin dist node_modules /tmp/hermes-ui-package/webui/
 
-          tar -czf "release/webui/${asset}" -C /tmp/hermes-web-ui-package webui
+          tar -czf "release/webui/${asset}" -C /tmp/hermes-ui-package webui
           sha256="$(shasum -a 256 "release/webui/${asset}" | awk '{print $1}')"
           size="$(stat -c%s "release/webui/${asset}")"
           printf '%s  %s\n' "$sha256" "$asset" > "release/webui/${asset}.sha256"