ops: kuma api key, voice verification, desk_active doc

- created kuma API key uk5_mavpoll-key, wired into mavpoll
- fixed basic auth field (kuma expects key as password, not username)
- switched mavpoll to network_mode: host (compose bridge can't reach host)
- fixed stale voice bind comment in docker-compose.yml
- verified voice listening on :9100, cross-container reachable
- updated PROGRESS.md ops footnote
- added ROADMAP.md

PROGRESS.md

@@ -189,18 +189,19 @@ The overnight session (`SESSION-05-07-2026.md`, 25 tasks) closed the previous
 
 ### Not built yet (ranked by ROI)
 
-1. **Purge + rotate the leaked db key** — a live AES key was committed at
-   `deploy/db_key.env` before it was gitignored. It must be scrubbed from git
-   history and rotated. Operator action, highest urgency.
-2. **Cold-start unlock** — the at-rest key still comes from env/config; the
+1. **Cold-start unlock** — the at-rest key still comes from env/config; the
    passkey→key L3 dance is a documented seam, not a feature. Until then the key
    sits in the container env.
-3. **Multi-user (SPEC item 8)** — deliberately deferred, see the tail.
+2. **Multi-user (SPEC item 8)** — deliberately deferred, see the tail.
 
 Closed (jul6 follow-ups): `/api/revert` now sits behind the same passkey
 step-up as POST `/tools`; `go.mod` direct deps (`onnxruntime_go`,
 `coder/websocket`, `robfig/cron`) are labeled correctly — `go mod tidy` can't
 run here because it walks the vendored `deps/go` toolchain tree.
+Purge+rotate leaked db key (#12) — investigated and closed: the key was
+**never committed** to git history (gitignored at introduction, no commit
+ever tracked `deploy/db_key.env`), so nothing to scrub. File stays on disk
+and in deploy env by design — at-rest encryption needs it at boot.
 
 Done earlier (2026-07-03): **act tool executor, store-backed, full flow**
 (`internal/tool` + `internal/store/tools.go` + `tools` CoreAPI methods).
@@ -281,9 +282,9 @@ Capability-class gaps — built but thin:
    optional-scale, not a gap. Persona prompt and custom TTS voice (kami-picked,
    replaces the irina floor — [[custom-voice-training]]) are still future items.
 
-Ops footnote: in the Docker deploy, voice-over-web needs mavend to bind its
-voice server on 0.0.0.0:9100 — unverified on the target host; until then the
-containers may only do the non-voice surfaces.
+Ops footnote: voice-over-web verified 2026-07-06 — mavend binds 0.0.0.0:9100
+and mavweb reaches it cross-container at mavend:9100 (nc -z confirmed).
+mavpoll uses network_mode=host to reach localhost services (netdata, kuma).
 
 ### Future / logged, not now