fix: ad-blocker hosts — download at build, apply at runtime

/etc/hosts is read-only during docker build. Now:
- Dockerfile: download hosts to /opt/huggingmes/adblock-hosts.txt
- start.sh: cat into /etc/hosts at runtime (runs as root before dropping privs)

Dockerfile

@@ -32,8 +32,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # ── Ad/tracker blocker — prevent HF abuse detection from browser fan-out ──
 # Steven Black unified hosts: 170k+ ad/tracker/malware domains → 0.0.0.0
+# /etc/hosts is read-only during build, so save to a file and apply at runtime
 RUN curl -sSL https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts \
-    | grep '^0.0.0.0' >> /etc/hosts
+    | grep '^0.0.0.0' > /opt/huggingmes/adblock-hosts.txt
 
 COPY --chown=hermes:hermes start.sh /opt/huggingmes/start.sh
 COPY --chown=hermes:hermes health-server.js /opt/huggingmes/health-server.js

start.sh

@@ -7,6 +7,11 @@ umask 0077
 # HuggingMes — Hermes Gateway for HF Spaces
 # ════════════════════════════════════════════════════════════════
 
+# ── Apply ad-blocker hosts (built during docker build, applied at runtime) ──
+if [ -f /opt/huggingmes/adblock-hosts.txt ]; then
+  cat /opt/huggingmes/adblock-hosts.txt >> /etc/hosts 2>/dev/null || true
+fi
+
 # ── Startup Banner ──
 APP_DIR="${HUGGINGMES_APP_DIR:-/opt/huggingmes}"
 HERMES_HOME="${HERMES_HOME:-/data/hermes}"