fix: copy Node.js runtime to final stage (webui BFF needs it)

The multi-stage build discarded Node.js from the runtime image,
causing start.sh 'node index.js' to fail silently.

Dockerfile

@@ -76,6 +76,14 @@ COPY --from=builder /app/hermes-agent /app/hermes-agent
 
 ENV PATH="/app/venv/bin:$PATH"
 
+# Copy Node.js runtime from builder (needed for webui-server BFF)
+COPY --from=builder /usr/local/bin/node /usr/local/bin/node
+COPY --from=builder /usr/local/lib/node_modules /usr/local/lib/node_modules
+# Symlink npm/npx if they don't exist
+RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm 2>/dev/null; \
+    ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx 2>/dev/null; \
+    true
+
 # Copy built web-ui from builder
 COPY --from=builder /app/webui-server /app/webui-server
 COPY --from=builder /app/webui-client /app/webui-client