terra: add Hermes Agent, wired to local ollama

Points Nous Research's Hermes Agent at terra's own ROCm ollama server
(gemma4:12b) as a custom OpenAI-compatible provider instead of a cloud
key. Native systemd mode via the hermes-agent flake's own NixOS module
— simpler than container mode, avoids the podman-rootful-sudo dance
its docs call out.

Also bumps OLLAMA_CONTEXT_LENGTH (and Hermes' mirrored model.context_length)
from ollama's ~4k default to 131072, load-tested with real multi-ten-
thousand-token prompts rather than just idle `ollama ps` checks — chosen
as the practical ceiling where VRAM headroom and prefill throughput both
start visibly degrading, not just the largest number that technically fit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.nix

@@ -33,6 +33,11 @@
     };
     authentik-nix.url = "github:nix-community/authentik-nix";
     nix-flatpak.url = "github:gmodena/nix-flatpak";
+    # Hermes Agent (see services/desktop/hermes-agent.nix) — Tier 2 platform
+    # per its own docs (best-effort Nix support, can break on any upstream
+    # commit), so pinned like everything else via flake.lock rather than
+    # followed loosely.
+    hermes-agent.url = "github:NousResearch/hermes-agent";
     # Own Hyprland plugin (border + title bar), public repo, fetched over
     # https (no credentials needed, unlike tome below). `nixpkgs.follows` is
     # what makes its packaged build ABI-correct — Hyprland plugins are
@@ -105,6 +110,7 @@
             sops-nix.nixosModules.sops
             home-manager.nixosModules.home-manager
             inputs.nix-flatpak.nixosModules.nix-flatpak
+            inputs.hermes-agent.nixosModules.default
             ./hosts/terra/configuration.nix
           ];
         };