security: recordings, webhooks, Contrack tokens, probe (08 §7 #3 #4 #6 #7)

A phone that only rang no longer gets a coworker's recording, transcript or
summary. The voicemail webhook leaves the transcript out. The saved Contrack
token only goes to its own address. The probe trusts X-Forwarded-For from a
local proxy only.

docs/spec/11-contacts.md

@@ -190,6 +190,9 @@ against the pinned version's `openapi.json`.
   checked by reading contacts).
 - Admin, same page: the **company Contrack account's token** (read-only is enough; read-write lets
   "Add to company contacts" work), write-only like the SMTP password (`hasCompanyToken` in GET).
+  Like it, the saved token only goes to the address it was saved for: Test with another address
+  sends none, and saving a new address needs the token typed again (400). A new address also
+  clears everyone's own token: they connect again (08 §7 #7).
   The admin makes that account in Contrack (e.g. `company@…`) and fills it like any other.
 - Contrack tokens expire in 90 days unless made with **Never**: the guide and the forms say to pick
   Never (or a year).