let Hermes manage MCPHub through its API

platform/mcphub/casaderoll-entrypoint.sh

@@ -30,8 +30,15 @@ if [ ! -s "$registry_file" ]; then
   cp /opt/casaderoll/config/mcp-registry.json "$registry_file"
   chmod 0600 "$registry_file"
 fi
-python3 /opt/casaderoll/configure-settings.py \
-  "$settings_file" /run/secrets/mcphub \
-  --registry "$registry_file"
+
+# MCPHub's own persistent settings and official API are the runtime source of
+# truth.  Render the declarative registry only for a fresh recovery (or an
+# explicitly requested migration), never on every image update: otherwise an
+# MCP installed through the dashboard/API would disappear on restart.
+if [ ! -s "$settings_file" ] || [ "${MCPHUB_RECONCILE:-0}" = "1" ]; then
+  python3 /opt/casaderoll/configure-settings.py \
+    "$settings_file" /run/secrets/mcphub \
+    --registry "$registry_file"
+fi
 
 exec "$@"