ops: kuma api key, voice verification, desk_active doc

- created kuma API key uk5_mavpoll-key, wired into mavpoll
- fixed basic auth field (kuma expects key as password, not username)
- switched mavpoll to network_mode: host (compose bridge can't reach host)
- fixed stale voice bind comment in docker-compose.yml
- verified voice listening on :9100, cross-container reachable
- updated PROGRESS.md ops footnote
- added ROADMAP.md

docker-compose.yml

@@ -63,10 +63,8 @@ services:
 
   mavweb:
     <<: *image
-    # NOTE: -voice must reach mavend's voice TCP server cross-container. That
-    # requires mavend to BIND its voice server on 0.0.0.0:9100 (Voice config,
-    # currently unset). Until that's configured, voice-over-web is inert — the
-    # rest of mavweb (/tools, passkey, dash) works over the core socket.
+    # voice.bind is 0.0.0.0:9100 in deploy/mavend.json so mavweb can reach it
+    # cross-container. Verified 2026-07-06.
     command: ["mavweb", "-addr", ":9201", "-voice", "mavend:9100", "-core", "/run/maven/mavend.sock"]
     depends_on: [mavend]
     ports: ["9201:9201"]
@@ -75,10 +73,12 @@ services:
 
   mavpoll:
     <<: *image
-    command: ["mavpoll", "-socket", "/run/maven/mavend.sock", "-netdata", "http://host.docker.internal:19999"]
+    network_mode: host
+    command: ["mavpoll", "-socket", "/run/maven/mavend.sock",
+              "-netdata", "http://127.0.0.1:19999",
+              "-kuma", "http://127.0.0.1:3001/metrics",
+              "-kuma-key", "uk5_mavpoll-key"]
     depends_on: [mavend]
-    extra_hosts:
-      - "host.docker.internal:host-gateway"   # reach netdata on the host
     volumes:
       - sockets:/run/maven