security: recordings, webhooks, Contrack tokens, probe (08 §7 #3 #4 #6 #7)

A phone that only rang no longer gets a coworker's recording, transcript or
summary. The voicemail webhook leaves the transcript out. The saved Contrack
token only goes to its own address. The probe trusts X-Forwarded-For from a
local proxy only.

docs/spec/10-ai.md

@@ -47,7 +47,7 @@ is logged and the message goes out without it.
   or timing out: the run stops and the call is retried next minute.
 - API: `GET /api/recordings` has `summary`, `hasTranscript`, `aiError`, and `?q=` (ILIKE on the
   transcript and summary, `%`/`_` taken literally). `GET /api/recordings/:id/transcript`: admins
-  and the people on the call, like the audio. Deleting a recording, and retention, delete its side
+  and the people on the call (made or answered it, not only rang), like the audio. Deleting a recording, and retention, delete its side
   files too.
 
 ## 4. Next (in order)