feat(nh3-svos): SVOS voice (app-voice) live — /voice route before Basic auth (lease bearer), unit + quiesce hook; app credentials vaulted

configs/svos-apps/svos-voice.service

@@ -0,0 +1,30 @@
+# eshpfi configs/svos-apps/ (infra-ops, 2026-10-07, a737a06 refresh), modelled on svoperatingsystem
+# deployment/nh3-svos/svos-interface.service. The credential is /etc/svos/voice.env (root 0600, SVOS_APP_CREDENTIAL),
+# minted by enrollment on the private kernel listener. Listed in the qemu-ga quiesce hook (configs/qemu-ga/svos/50-svos).
+[Unit]
+Description=SVOS Voice app (app-voice, U12)
+After=svos-kernel.service
+Requires=svos-kernel.service
+ConditionPathExists=/etc/svos/voice.env
+[Service]
+Type=simple
+User=svc-svos
+Group=svc-svos
+UMask=0077
+WorkingDirectory=/var/lib/svos
+EnvironmentFile=/etc/svos/voice.env
+Environment=SVOS_KERNEL_URL=http://127.0.0.1:8400
+Environment=SVOS_DATA_ROOT=/var/lib/svos
+Environment=SVOS_APP_LISTEN=127.0.0.1:8402
+ExecStart=/opt/svos/current/apps-env/bin/svos-voice
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+KillMode=control-group
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/var/lib/svos
+[Install]
+WantedBy=multi-user.target