fix(v8.1): Kritische Bugs behoben — system_status, model-routing, UI

P0:
- hermes_agent: system_status Key-Mismatch behoben (cpu_pct→cpu.percent,
  ram_used_gb→ram.used/1024³, gtt analog) — zeigt jetzt echte Werte statt '?'
- guides-data: & in 4 Titel-Strings → & (Svelte text-node rendert keine HTML-Entities)

P1:
- hermes_agent: choose_model() um recherchier/such/vergleich/etc. erweitert;
  kein Downgrade wenn komplexes Modell bereits geladen
- routers/hermes: asyncio.get_event_loop() → get_running_loop() (Whisper+TTS)
- maintenance: llama-swap Update akzeptiert optionales sudo-PW via stdin;
  import os hinzugefügt (fix NameError in updates()); UpdateReq-Model
- ServerPanel: Engine-Update fragt jetzt nach sudo-PW (analog OS-Update)
- HermesPanel: Chat-History in sessionStorage (überlebt Reload);
  Stopp-Button während Hermes antwortet; Verlauf-löschen-Button
- ConnectPanel: opencode.json → opencode.jsonc; provider → providers;
  LAN-IP Override (localStorage) für NPM-Proxy-Setups

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routers/hermes.py

@@ -148,7 +148,7 @@ async def transcribe_audio(audio: UploadFile = File(...)):
         tmp = Path(f.name)
         tmp.write_bytes(await audio.read())
     try:
-        segments, _ = await asyncio.get_event_loop().run_in_executor(
+        segments, _ = await asyncio.get_running_loop().run_in_executor(
             None, lambda: model.transcribe(str(tmp), language="de")
         )
         text = " ".join(s.text.strip() for s in segments).strip()
@@ -165,7 +165,7 @@ async def text_to_speech(body: dict):
     text = (body.get("text") or "").strip()
     if not text:
         return JSONResponse(status_code=400, content={"error": "Kein Text angegeben."})
-    audio = await asyncio.get_event_loop().run_in_executor(None, lambda: _tts(text))
+    audio = await asyncio.get_running_loop().run_in_executor(None, lambda: _tts(text))
     if audio is None:
         return JSONResponse(
             status_code=503,

routers/maintenance.py

@@ -6,6 +6,7 @@ laeuft als Hintergrund-Job mit Live-Log. Spaeter wandert hier ggf. mehr
 Server-Wartung hinein (siehe Roadmap: Server-Management).
 """
 
+import os
 import shlex
 import subprocess
 import asyncio
@@ -22,12 +23,22 @@ router = APIRouter(prefix="/api", dependencies=[Depends(auth)])
 class PwdReq(BaseModel):
     password: str
 
+class UpdateReq(BaseModel):
+    password: str = ""
+
 @router.post("/update")
-def update():
-    """LLM-Engine (llama.cpp) aktualisieren — Befehl aus MC_UPDATE_CMD."""
+def update(req: UpdateReq = None):
+    """LLM-Engine (llama.cpp) aktualisieren — Befehl aus MC_UPDATE_CMD.
+    Optionales Passwort fuer sudo-Befehle (via stdin, nicht in argv)."""
     if not UPDATE_CMD:
         raise HTTPException(400, "Kein Update-Befehl gesetzt (MC_UPDATE_CMD).")
-    job_id = start_job(shlex.split(UPDATE_CMD), "llama.cpp-Update")
+    pwd = (req.password if req else "").strip()
+    if pwd:
+        args = ["sudo", "-S", "bash", "-c", UPDATE_CMD]
+        job_id = start_job(args, "llama.cpp-Update", stdin_data=pwd + "\n",
+                           log_cmd=f"$ sudo {UPDATE_CMD}")
+    else:
+        job_id = start_job(shlex.split(UPDATE_CMD), "llama.cpp-Update")
     return {"job_id": job_id}
 
 @router.post("/self-update")
@@ -118,7 +129,7 @@ def updates():
     apt_cache_age_h = None
     try:
         import time as _time
-        apt_cache_age_h = round((_time.time() - os.path.getmtime("/var/lib/apt/lists")) / 3600, 1)
+        apt_cache_age_h = round((_time.time() - os.path.getmtime("/var/lib/apt/lists")) / 3600, 1)  # noqa: PTH
     except Exception:  # noqa: BLE001
         pass
     return {"os": os_count, "models": models, "engine": 1 if _engine_update_available() else 0,