feat(nh3-svos): SVOS voice (app-voice) live — /voice route before Basic auth (lease bearer), unit + quiesce hook; app credentials vaulted

configs/qemu-ga/svos/50-svos

@@ -12,7 +12,7 @@ import tempfile
 import time
 
 SERVICES = ('svos-kernel.service', 'svos-interface.service', 'svos-terminal.service',
-            'svos-knowledge.service', 'svos-postoffice.service')
+            'svos-knowledge.service', 'svos-postoffice.service', 'svos-voice.service')
 
 class Quiesce:
     def __init__(self, directory, *, run=None):

configs/qemu-ga/svos/README.md

@@ -13,3 +13,4 @@
 - 2026-10-07 (a737a06 refresh): `SERVICES` gained `svos-terminal`, `svos-knowledge` and `svos-postoffice` before
   they were started. The hook restores only the units that were active at freeze, so a declared-but-stopped app
   (postoffice until its bridge handle exists) is recorded as inactive and left stopped.
+- 2026-10-08: `svos-voice` added (Prime: voice on), before it started.

configs/qemu-ga/svos/test_quiesce.py

@@ -10,7 +10,8 @@ class QuiesceTests(unittest.TestCase):
   spec=importlib.util.spec_from_loader('svos_quiesce',loader)
   self.module=importlib.util.module_from_spec(spec);spec.loader.exec_module(self.module)
   self.states={'svos-kernel.service':('active','success'),'svos-interface.service':('inactive','success'),
-   'svos-terminal.service':('inactive','success'),'svos-knowledge.service':('inactive','success'),'svos-postoffice.service':('inactive','success')}
+   'svos-terminal.service':('inactive','success'),'svos-knowledge.service':('inactive','success'),'svos-postoffice.service':('inactive','success'),
+   'svos-voice.service':('inactive','success')}
   self.calls=[];self.stop_fail=False;self.start_fail=False;self.dirty_stop=False
   def run(args,**kwargs):
    self.calls.append(args)