feat: connect Shane voice sessions to memory

Dockerfile

@@ -60,8 +60,9 @@ COPY web/token_server.py /opt/voice/token_server.py
 # Config files
 COPY livekit.yaml /etc/livekit.yaml
 COPY supervisord.conf /etc/supervisor/conf.d/voice.conf
+COPY config/users.json /etc/hope/users.json
 
-# Configure nginx to serve the voice UI on port 8090 over HTTPS.
+# Configure nginx to serve the voice UI on WEB_PORT (9178 by default).
 # Browsers require a secure context (HTTPS or localhost) for microphone access.
 # The self-signed cert (with the LAN IP in the SAN) is generated at container
 # start by entrypoint.sh.
@@ -70,13 +71,15 @@ RUN rm -f /etc/nginx/sites-enabled/default \
     && ln -sf /etc/nginx/sites-available/voice /etc/nginx/sites-enabled/voice \
     && mkdir -p /etc/voice/certs
 
-# Create non-root user for agent
-RUN useradd -m -s /bin/bash voiceuser || true
+# Create non-root user for agent and protect the server-side user registry.
+RUN useradd -m -s /bin/bash voiceuser || true \
+    && chown -R voiceuser:voiceuser /etc/hope \
+    && chmod 600 /etc/hope/users.json
 
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-EXPOSE 7880 7881 7882/udp 8090
+EXPOSE 7880 7881 7882/udp 9178
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["supervisord", "-n", "-c", "/etc/supervisor/conf.d/voice.conf"]