voice-bridge: Discord voice <-> Lotus voice room (patched nether-voicebridge)

Production setup for the Discord voice bridge on LXC 151: config and
appservice-registration templates (secrets rendered on the server), an
idempotent install script (one Synapse restart on first install, creates
the bot account so it can be invited), and a hardened systemd unit.

voice-limit-guard: VOICE_LIMIT_EXEMPT_USERS lets the bridge's own bot
listen in a call without taking a slot; relayed Discord speakers still
count. Unit tests added (61 pass); verified live on the dev stack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

systemd/lotus-voice-bridge.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Lotus voice bridge (Discord voice <-> Matrix calls, nether-voicebridge)
+After=network-online.target matrix-synapse.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lotus-voice
+Group=lotus-voice
+Environment=CONFIG_PATH=/etc/lotus-voice/config.toml
+Environment=RUST_LOG=info
+ExecStart=/opt/lotus-voice/lotus-voice-bridge
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=lotus-voice-bridge
+
+# Resource limits (Opus encode/decode + LiveKit + Discord voice per call)
+MemoryMax=1G
+CPUQuota=150%
+
+# Hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/var/lib/lotus-voice /etc/lotus-voice
+
+[Install]
+WantedBy=multi-user.target

systemd/voice-limit-guard.service

@@ -19,6 +19,8 @@ Environment=GUARD_BIND_PORT=8070
 Environment=GUARD_UPSTREAM=http://127.0.0.1:8071
 Environment=LIVEKIT_API=http://127.0.0.1:7880
 Environment=SYNAPSE_API=http://127.0.0.1:8008
+# The voice bridge's bot listens in calls but is not a person (Discord speakers still count).
+Environment=VOICE_LIMIT_EXEMPT_USERS=@lotus-voice_bot:matrix\\.lotusguild\\.org
 
 [Install]
 WantedBy=multi-user.target