Lets the phone reach the agent when it is off retiolum. Long read timeout
and no buffering because /v1/chat/completions streams SSE for the whole
turn; fast connect timeout because coaxmetal is a laptop.

The bearer token is the only authn on this lane and the app cannot do
mTLS, so the location allowlist and limit_req are damage control: only the
endpoints the app calls are reachable, and /api/pty stays 404 even if
backend.mode is enabled later.

Voice both ways over Matrix: local faster-whisper (the "voice" dep group)
transcribes Element voice notes, and replies are spoken by a piper command
provider against a pinned en_US-lessac-medium voice. The built-in piper and
edge backends cannot work here, they lazily pip-install into a read-only
sealed venv. stt.prompt biases the jargon: without it "herdr" transcribes
as "Herter".

herdr runs as lass and keeps its socket under lass's HOME, so the agent
reaches the herd through a sudo wrapper plus a SKILL.md that documents it.
That needs NoNewPrivileges off, sudo is setuid.

The OpenAI-compatible API server is the assistant-button lane for the
WakeHermesClaw app, bound to the retiolum address resolved at start.

The krebs-CA cert expired ~594 days ago and acme-order-renew-jelly.r keeps
failing (exit 11, negative remaining duration), leaving yellow degraded.
jellyfin is reachable over plain http on jelly.r and directly on :8096.

also document why transmission-gc talks to 128.0.0.1: the daemon runs in its
own netns (t1), the gc unit does not (t2), so localhost is not the daemon.

mpvpaper rendered a looping video on every output, which makes every frame
full-screen motion. On the sunshine-streamed tablet screen that meant a
constantly saturated encoder and an unusable stream (97% of frames dropped
at 5 Mbps), and on the real outputs it is pointless power draw.

noctalia owns the desktop background again (wallpaper.enabled = true); pick
the image in its wallpaper panel. ~/wallpaper is no longer seeded, but
lockscreen still uses whatever is in it.

Streams a sway headless output to Moonlight with Sunshine, so an Android
tablet works as a wireless second screen with its touchscreen acting as a
touchpad on the shared cursor.

The output is created once per session and stays disabled until a client
streams: sunshine's prep-cmd enables it at exactly the resolution and
refresh rate the client asks for, and disables it afterwards so sway moves
the workspace back to the real screens. wlroots never reuses a headless
output name, so the name is discovered at creation time, remembered in
$XDG_RUNTIME_DIR and handed to sunshine as an output_name command line
override instead of being hardcoded.

Replaces 2configs/sunshine.nix, which only shipped a manual launcher
script.