security: recordings, webhooks, Contrack tokens, probe (08 §7 #3 #4 #6 #7)

A phone that only rang no longer gets a coworker's recording, transcript or
summary. The voicemail webhook leaves the transcript out. The saved Contrack
token only goes to its own address. The probe trusts X-Forwarded-For from a
local proxy only.

docs/admin-guide/network.md

@@ -103,7 +103,8 @@ sudo ufw allow 8080/tcp
 (On GitHub, the downloads are at `https://github.com/iamdoubz/selfphoneng/releases/download/$v/…`.)
 To try it first without the service, run `./selfphoneng-probe-linux-x64` and open
 `http://<machine>:8080/healthz`. `PORT` changes the port; behind your own HTTPS reverse proxy
-that sets X-Forwarded-For, also set `TRUST_PROXY=true`.
+on the same machine that sets X-Forwarded-For, also set `TRUST_PROXY=true`. The probe then only
+listens on 127.0.0.1 (`HOST` changes it) and only believes X-Forwarded-For from there.
 
 **With Docker:**