swarm-stt: say plainly that the network is not restricted and the decoder can read the unit's credentials

nix/host-modules/swarm-stt.nix

@@ -12,7 +12,16 @@
 #
 # Its own network namespace on the bridge, as ./swarm-claude-login.nix has: it
 # reaches the swarm services by name and nothing on the host's loopback. It
-# talks only to the queue, the store and authelia, so it can run on any host.
+# needs only the queue, the store and authelia, so it can run on any host.
+#
+# ⚠️ Nothing here limits what it may reach: the container's egress is whatever
+# the bridge and the host's NAT allow. `ffmpeg` and `whisper-cli` run as
+# children of the daemon, in the same network namespace and user, and can read
+# the unit's credentials (the store leaf, the queue client secret). A decoder
+# exploit on a hostile file could read them and send them out. The sandbox
+# below narrows what such an exploit can do on the host; the network side
+# waits on the strict-egress series covering service containers, or on running
+# the decode in a child with no network and no credentials.
 #
 # The container holds one credential, its own store leaf, which nspawn hands in
 # as a system credential with no copy on disk. The daemon reads its queue
@@ -315,9 +324,8 @@ in
 
               # The sandbox for a service that decodes files strangers sent:
               # the only writable path is its state directory, it sees no
-              # other user's processes or devices, cannot gain privileges, and
-              # may open sockets to the queue, the store and authelia only
-              # (the container's netns has no other route).
+              # other user's processes or devices, and cannot gain
+              # privileges. It does NOT limit the network (see the header).
               StateDirectory = unit;
               StateDirectoryMode = "0700";
               NoNewPrivileges = true;