Block all DDS off the Pi and bring up PipeWire behind the firewall

ROS never leaves the robot, by the owner's decision: the firewall drops domain
42's DDS ports on every interface but loopback (usb0 included), discovery is
pinned to LOCALHOST, and hermes_mcp is the only bridge to the outside. PipeWire
1.0.5 runs as hermes's user services with its network server on TCP 4713; the
firewall, loaded at boot before it, is the protection. Verified from talos: 4713
connects over usb0 and times out over Wi-Fi.

CONTEXT.md brought up to date: the face service, gaze, recognition, the firewall,
and what is left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs

pi/pipewire/50-network-server.conf

@@ -1,11 +1,13 @@
 # ~/.config/pipewire/pipewire-pulse.conf.d/50-network-server.conf  (on the Pi)
 #
-# Lets your Omarchy machine reach the robot's microphone and speaker over the
-# network, using the PulseAudio protocol that pipewire-pulse speaks.
+# Lets the host reach the robot's microphone and speaker over the USB link, using the
+# PulseAudio protocol that pipewire-pulse speaks.
 #
 # This replaces the default address list, so "unix:native" must stay in it.
-# Anyone on the LAN who can reach port 4713 could listen to the microphone;
-# the nftables rules installed alongside restrict it to your machine's IP.
+# It listens on every interface and is unauthenticated: anyone who can reach port 4713 could
+# listen to the microphone. The protection is the firewall (pi/nftables-robot.nft, loaded at boot
+# by robot-firewall.service), which accepts 4713 only on usb0 from 10.55.0.1 and drops it on every
+# other interface, Wi-Fi included. Do not enable this without that firewall loaded.
 
 pulse.properties = {
     server.address = [