feat(sync): warn when keys live in ephemeral .env on a Space

fix(router): explicit 404 for legacy /api/sessions/<id>/chat/stream

feat(router): add /hmd passthrough for off-Space dashboard access

Initial release: HuggingMes + Hermes WebUI integration