M0: toolchain, monorepo scaffold, gateway plugin skeleton, CMP app

- gateway-plugin/: android platform plugin (plugin.yaml + adapter.py
  register(ctx) + no-op AndroidAdapter) + stub modules for M1-M5
- app/: Compose Multiplatform project (shared KMP + androidApp +
  desktopApp) with Gradle wrapper; builds :androidApp:assembleDebug
  and :desktopApp:compileKotlin
- scripts/guard_hermes_agent.sh + pre-commit hook: fail if hermes-agent/
  is staged (read-only reference, never committed)
- .gitignore excludes hermes-agent/; docs/ reference library

docs/diagrams/architecture.mmd

@@ -0,0 +1,54 @@
+%% Iris x Hermes — architecture (mermaid)
+%% Render with any mermaid viewer (e.g. https://mermaid.live or `mmdc`).
+flowchart TB
+    subgraph HOST["User's machine (home server / PC)"]
+        subgraph GW["hermes gateway (ONE process)"]
+            AGENT["Agent core<br/>(run_agent.py)"]
+            SESS["Sessions<br/>(SQLite + FTS5)"]
+            CRON["Cron scheduler"]
+            subgraph PLUGIN["android PLATFORM PLUGIN"]
+                ADAPTER["AndroidAdapter<br/>(BasePlatformAdapter)"]
+                OUTBOX["Outbox (SQLite)<br/>+ sync cursor"]
+                PUSH["push.py<br/>FcmBackend / NtfyBackend"]
+                MEDIA["media.py<br/>cache + chunk stream"]
+                PAIR["pairing.py<br/>token + device registry"]
+                SEARCH["search.py<br/>FTS5 bridge"]
+            end
+            WSS["WebSocket SERVER<br/>(websockets) ws://host:8790/ws"]
+        end
+        AGENT -->|legacy stream callbacks| ADAPTER
+        CRON -->|deliver=android:chat:thread| ADAPTER
+        ADAPTER <--> WSS
+        ADAPTER <--> OUTBOX
+        ADAPTER <--> PUSH
+        ADAPTER <--> MEDIA
+        ADAPTER <--> PAIR
+        ADAPTER <--> SEARCH
+        ADAPTER <--> SESS
+    end
+
+    subgraph CLOUD["Cloud relays"]
+        FCM["Google FCM"]
+        NTFY["ntfy (self-host / ntfy.sh)"]
+    end
+
+    subgraph DEVICES["Clients"]
+        PHONE["ANDROID APP<br/>(Kotlin / Compose)<br/>WS client + ExoPlayer + FCM"]
+        DESKTOP["DESKTOP APP<br/>(Compose Multiplatform)<br/>WS client + tray + desktop player"]
+    end
+
+    WSS <-->|WSS JSON + binary media| PHONE
+    WSS <-->|WSS JSON + binary media| DESKTOP
+    PUSH -->|FCM HTTP v1| FCM
+    PUSH -->|ntfy publish| NTFY
+    FCM -->|wake (data msg)| PHONE
+    NTFY -->|subscribe| PHONE
+
+    classDef host fill:#eef,stroke:#333;
+    classDef plugin fill:#efe,stroke:#333;
+    classDef device fill:#fee,stroke:#333;
+    classDef cloud fill:#ffe,stroke:#333;
+    class GW,AGENT,SESS,CRON,OUTBOX,PUSH,MEDIA,PAIR,SEARCH,WSS host;
+    class ADAPTER plugin;
+    class PHONE,DESKTOP device;
+    class FCM,NTFY cloud;