security: recordings, webhooks, Contrack tokens, probe (08 §7 #3 #4 #6 #7)

A phone that only rang no longer gets a coworker's recording, transcript or
summary. The voicemail webhook leaves the transcript out. The saved Contrack
token only goes to its own address. The probe trusts X-Forwarded-For from a
local proxy only.

deploy/probe/compose.yml

@@ -6,8 +6,9 @@
 #   docker compose -f deploy/probe/compose.yml up -d     → http://<this machine>:8080
 #
 # Host networking, so it sees the real address that asks (Docker's published ports can hide it).
-# Behind your own HTTPS reverse proxy instead: set PORT to a local port, TRUST_PROXY=true, and have
-# the proxy set X-Forwarded-For. The SIP checks connect out from here, so no other ports are needed.
+# Behind your own HTTPS reverse proxy on this machine instead: set PORT to a local port,
+# TRUST_PROXY=true (it then listens on 127.0.0.1 only; HOST changes that), and have the proxy set
+# X-Forwarded-For. The SIP checks connect out from here, so no other ports are needed.
 services:
   probe:
     # Built by each release, like the api and asterisk images (pick your registry and version).

deploy/probe/selfphoneng-probe.service

@@ -12,7 +12,8 @@ Wants=network-online.target
 [Service]
 ExecStart=/usr/local/bin/selfphoneng-probe
 Environment=PORT=8080
-# Behind your own HTTPS reverse proxy that sets X-Forwarded-For: PORT to a local one, and
+# Behind your own HTTPS reverse proxy on this machine that sets X-Forwarded-For: PORT to a local
+# one, and TRUST_PROXY=true (it then listens on 127.0.0.1 only; HOST changes that).
 #Environment=TRUST_PROXY=true
 Restart=always
 RestartSec=5