security: a key for the network test probe (08 §7 #9)

Settings → Network makes a key, shown once and stored encrypted; the api sends
it to the probe as a Bearer token, and a new probe address drops it. A probe
with PROBE_KEY only answers that key. Without one it stays open, and
Diagnostics strongly recommends setting it.

docs/admin-guide/network.md

@@ -118,6 +118,14 @@ against someone else, and each address gets a few tests per 10 minutes. Its SIP
 OPTIONS request; if you run fail2ban or CrowdSec, add the probe's address to their allow list so a
 test never counts toward a ban.
 
+**Give the probe a key (strongly recommended).** Without one, anyone who finds your probe can use
+it to test their own address, and spend its few tests per 10 minutes. After saving the address,
+click **Generate key** under it, copy the `PROBE_KEY=…` line, and add it to the probe: under
+`environment:` in `deploy/probe/compose.yml` (`PROBE_KEY: '…'`), or as an `Environment=PROBE_KEY=…`
+line in the service file (`sudo systemctl edit selfphoneng-probe`). Restart the probe. From then on
+it only answers this server, and System → Diagnostics stops warning about it. The key is shown only
+once; a new probe address drops it, so generate one for the new probe.
+
 ## Firewall
 
 Allow only the ports in the [port table](README.md#ports). All SelfPhoneNG containers use the