ops(svos): U13 phase B — nh3-svos on v0.0.9 (schema 12), kernel app origin, seat-host and high-seat origins, bridge env on nh3-dev

Prime approved svos-dev's U13 pre-edit ask (2026-10-10 1639).
- B1: release afab123 on nh3-svos (kernel 0.0.9, migration 11->12) after a
  vzdump and an offline svos.db copy; app-terminal and app-postoffice held on
  b588510 by drop-ins until the edit.
- B2: --app-listen 127.0.0.1:8410 (drop-in) fronted by Caddy as
  svos-kernel.phasefinal.com on the LAN, allowlisted to nh3-dev; the path list
  adds /auth/kernel-key, which every connector client needs. DNS rewrite on
  the three internal AdGuards.
- B3/B4: svos-seathost (-> :8404) and svos-highseat (-> :8773) on nh3-dev's
  fleet Caddy, allowlisted to nh3-svos; /opt/svos apps env on nh3-dev with
  svos-postoffice[push] (althing-core 3.7.0 from althing 7a2a1c1) and
  svos-terminal. The fleet Caddyfile is now tracked in configs/.

configs/svos-kernel/20-app-listen.conf

@@ -0,0 +1,9 @@
+# /etc/systemd/system/svos-kernel.service.d/20-app-listen.conf on nh3-svos (U13 B2, 2026-10-10, Prime-approved).
+# Adds the kernel's second listener for apps OFF the box (kernel >= 0.0.9, svoperatingsystem U9a). A request on
+# 127.0.0.1:8410 is never a human and loopback trust never applies there; Caddy fronts it as svos-kernel.phasefinal.com
+# on the LAN, allowlisted to nh3-dev (configs/svos-front/Caddyfile). The primary listener is unchanged. The ExecStart
+# below is the release unit's (deployment/nh3-svos/svos-kernel.service) plus --app-listen; keep the two in step when
+# that unit changes. serve refuses --app-listen on the primary listener's port.
+[Service]
+ExecStart=
+ExecStart=/opt/svos/current/kernel-env/bin/svos-kernel serve --data-root /var/lib/svos --host 127.0.0.1 --port 8400 --trust-loopback --app-listen 127.0.0.1:8410