v0.7.1 — dashboard backend as a standalone sidecar

Restores the Workflows dashboard tab on a hardened Hermes that no longer auto-imports a non-bundled plugin's Python backend (GHSA-5qr3-c538-wm9j / #43719).

The backend now runs as a standalone sidecar — hermes-workflows-dashboard-api — that mounts the existing plugin_api.py router verbatim under /api/plugins/workflows (plus /healthz). The operator's reverse proxy points that path at the sidecar in front of the dashboard, so the frontend is unchanged. Binds loopback only and inherits the dashboard's trust model (loopback + proxy auth); host/port via plugins.workflows.dashboard_api_host / …_port (default 127.0.0.1:9123).

Docs ship systemd + Caddy + nginx wiring (docs/dashboard.md). A bundled install needs none of it. No Hermes core edits.