feat(auto-improve): workflow Hermes d'analyse et amélioration de la doc

Pipeline complet dans feature/hermes-auto-improve :
- auto-improve.py : analyse admin/ avec hermes --profile funk-ai, applique
  les améliorations, committe dans la branche, ré-ingère dans Qdrant
- trigger-server.py : HTTP 9095 (POST /trigger, /trigger/all, /trigger/subdir,
  /trigger/dry-run) pour déclenchement depuis n8n ou manuellement
- Ansible role hermes_auto_improve : déploie scripts + service systemd sur s01
- n8n workflow "Hermes Auto-Improve" (ID: CX72UUOempE1YtNL) : schedule
  hebdo dimanche 09h + webhook manuel → analyse → résumé LLM → email

Tout reste dans cette branche — rien ne touche main avant review.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/hermes_auto_improve/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+hermes_auto_improve_port: 9095
+hermes_auto_improve_repo: /srv/data/lab/Funk-lab
+hermes_auto_improve_branch: feature/hermes-auto-improve
+hermes_auto_improve_state_dir: /var/lib/hermes-auto-improve
+hermes_auto_improve_log: /var/log/hermes-auto-improve.log

ansible/roles/hermes_auto_improve/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Restart hermes-auto-improve-server
+  ansible.builtin.systemd:
+    name: hermes-auto-improve
+    state: restarted
+    daemon_reload: true
+
+- name: Reload nftables
+  ansible.builtin.service:
+    name: nftables
+    state: reloaded

ansible/roles/hermes_auto_improve/tasks/main.yml

@@ -0,0 +1,43 @@
+---
+- name: Create state directory
+  ansible.builtin.file:
+    path: "{{ hermes_auto_improve_state_dir }}"
+    state: directory
+    mode: '0755'
+
+- name: Deploy auto-improve script
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../tools/hermes-auto-improve/auto-improve.py"
+    dest: /usr/local/bin/hermes-auto-improve
+    mode: '0755'
+  notify: Restart hermes-auto-improve-server
+
+- name: Deploy trigger server
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../tools/hermes-auto-improve/trigger-server.py"
+    dest: /usr/local/bin/hermes-auto-improve-server
+    mode: '0755'
+  notify: Restart hermes-auto-improve-server
+
+- name: Deploy systemd service
+  ansible.builtin.template:
+    src: hermes-auto-improve.service.j2
+    dest: /etc/systemd/system/hermes-auto-improve.service
+    mode: '0644'
+  notify: Restart hermes-auto-improve-server
+
+- name: Enable and start service
+  ansible.builtin.systemd:
+    name: hermes-auto-improve
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Open port in nftables
+  ansible.builtin.lineinfile:
+    path: /etc/nftables.conf
+    insertafter: '# prometheus'
+    line: "    tcp dport {{ hermes_auto_improve_port }} ip saddr { 10.42.0.0/16, 192.168.10.0/24 } accept comment \"hermes-auto-improve\""
+    state: present
+  notify: Reload nftables
+  ignore_errors: true

ansible/roles/hermes_auto_improve/templates/hermes-auto-improve.service.j2

@@ -0,0 +1,17 @@
+[Unit]
+Description=Hermes Auto-Improve Trigger Server
+After=network-online.target hermes-agent.service
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/bin/python3 /usr/local/bin/hermes-auto-improve-server
+Restart=on-failure
+RestartSec=15s
+Environment=PYTHONUNBUFFERED=1
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=hermes-auto-improve
+
+[Install]
+WantedBy=multi-user.target