fix: sync all session sources and add Jobs API configuration

[54laowang]

Summary

Fixes two critical bugs preventing Web UI from displaying session records and cron jobs.

Bug #1: Session Sync Filtering

Problem: session-sync.ts hardcoded listHermesSessionSummaries('api_server', ...) which only fetched sessions with source='api_server'. Hermes Agent sessions have sources like cli, telegram, weixin, feishu, wecom, qqbot, cron — never api_server.

Fix: Changed to listHermesSessionSummaries(undefined, ...) to sync all sources.

Files changed:

• packages/server/src/services/hermes/session-sync.ts

Bug #2: Session Source Override

Problem: createSession() hardcoded source: 'api_server' overriding actual source values from Hermes.

Fix: Added source?: string to CreateSessionData interface and changed to source: data.source || 'api_server' to preserve original source.

Files changed:

• packages/server/src/db/hermes/session-store.ts
• packages/server/src/services/hermes/session-sync.ts

Bug #3: Jobs API Authentication

Problem: Jobs page returned Invalid API key because Web UI couldn't find API_SERVER_KEY.

Fix: Document that API_SERVER_KEY must be in ~/.hermes/.env (for default profile) or ~/.hermes/profiles//.env (for other profiles).

Files changed:

• README.md — Added configuration documentation

Configuration Required

After deploying this fix, users need to create .env file:

Default profile (~/.hermes/.env):

API_SERVER_KEY="your-api-server-key"

Other profiles (~/.hermes/profiles//.env):

API_SERVER_KEY="your-api-server-key"

The API key is found in ~/.hermes/config.yaml:

platforms:
  api_server:
    key: "your-api-server-key"  # Copy this value to .env

Test Plan

1. Create ~/.hermes/.env with API_SERVER_KEY
2. Restart Web UI
3. Verify Sessions page shows all sources (cli, telegram, weixin, etc.)
4. Verify Jobs page shows all cron jobs
5. Verify source badges display correctly

Closes #368

[albert748]

Hey @54laowang, I've opened #373 which includes the source filter fix (same as yours) plus two additional fixes: (1) incremental sync via hermes_id dedup column — so existing users don't need to wipe their DB, and (2) SessionDeleter race guard from #354. The Jobs API config docs in your PR are useful but orthogonal — might be better as a separate docs PR. Hope we can consolidate!

[hanzckernel]

这个 PR 当前正文里引用/关闭了 #368，但它看起来没有处理 #368 描述的审批显示/审批响应问题。

#368 的根因更像是 Hermes Agent API run/event 流缺少审批控制面：WUI 需要从 /v1/runs/{run_id}/events 收到结构化审批事件，并通过 run-scoped endpoint 回写 once | session | always | deny。

相关上游跟踪：

• [Bug]: API Server/WebUI path cannot surface dangerous command approval prompts NousResearch/hermes-agent#15802
• feat(api_server): wire up dangerous command approval for /v1/runs SSE stream NousResearch/hermes-agent#6059

请把正文里的 Closes #368 / Fixes #368 去掉，让 #368 保持打开。