simplify Athena runtime and centralize MCP management

install.sh

@@ -485,16 +485,14 @@ build_and_start() {
       "from huggingface_hub import snapshot_download; snapshot_download('black-forest-labs/FLUX.2-klein-4B', revision='303481f0390afb112393f9d77e8f0be72fcefeb7', local_dir='/download')"
     chmod -R a-w "${FLUX_MODEL_DIR:-/data/models/FLUX.2-klein-4B}"
   fi
-  # Creates the shared internal tools network before Open WebUI is created.
-  # Web search always starts; HA/ARR/Unraid only start when their root-only
-  # secret files and required local artifacts are present.
+  # Creates the tools network and deploys the only host-bound MCP: Operator.
+  # Portable MCPs and Hermes live on Unraid and are restored through Appdata.
   "$STACK_DIR/platform/mcp/install-tools.sh"
-  "$STACK_DIR/platform/hermes/install-hermes.sh"
   docker compose --env-file "$SECRETS_DIR/stack.env" --profile inference create \
     llama-fast llama-medium llama-large llama-ultra llama-experimental
   docker compose --env-file "$SECRETS_DIR/stack.env" --profile image create flux-worker
   docker compose --env-file "$SECRETS_DIR/stack.env" up -d --build \
-    xtts piper tts-gateway profile-controller router open-webui hermes
+    wireguard-gateway xtts piper tts-gateway profile-controller router backup
   if [[ ${WIREGUARD_MODE:-container} == container ]]; then
     systemctl restart mike-ai-container-vpn-guard.service
   fi
@@ -541,16 +539,6 @@ PY
   grep -Fxq 'INSTALL_READINESS_OK' <<<"$activation_output" || \
     die "Medium-Standardprofil lieferte keinen bestätigten Readiness-Marker"
 
-  log "Hermes-Profile aus der Standardmatrix anlegen"
-  "$STACK_DIR/platform/hermes/install-profiles.sh"
-
-  log "OpenWebUI-Filter und MCP-Registry synchronisieren"
-  "$STACK_DIR/platform/openwebui/install-filters.sh"
-
-  if [[ ${INSTALL_HERMES_WEBUI:-true} == true ]]; then
-    log "Entfernbare Hermes Community-WebUI installieren"
-    "$STACK_DIR/platform/hermes/install-webui.sh"
-  fi
 }
 
 hostnamectl set-hostname "$AI_HOSTNAME"
@@ -578,9 +566,8 @@ else
   vpn_address=$AI_BIND_ADDRESS
 fi
 cat <<EOF
-OpenWebUI:  http://${vpn_address}:8080
 Router-API: http://${vpn_address}:8081
-Hermes:     http://${vpn_address}:9119
+Hermes läuft mit MCPHub auf Unraid und nutzt diese Router-API.
 
 Die geheimen Schlüssel liegen ausschließlich unter $SECRETS_DIR (0600).
 Im Container-Modus stammen Peer, Adresse und Heimrouten vollständig aus dem