feat: connect Shane voice sessions to memory

PLAN.md

@@ -4,7 +4,7 @@
 
 Replace the Voice API's single shared Cognee memory connection with a per-user connection to the deployed Shane Memory System. The first Voice user is `shane`; his server-side profile uses the existing remote memory token pulled from Unraid. Future Voice users can point to separate memory servers and tokens without exposing those credentials to the browser or LLM.
 
-This document is the implementation plan. In this investigation pass, only the bootstrap user registry and requested Azure voice/prompt changes were made; the authentication and per-user runtime described below are not implemented yet.
+This document is the implementation plan. The Unraid test deployment now implements the Shane bootstrap path: trusted Shane room identity, server-side profile loading, authenticated per-session memory MCP, and Dragon HD Omni speech. The login UI and full multi-user isolation hardening described below remain future work.
 
 ## Investigation summary
 
@@ -14,8 +14,8 @@ This document is the implementation plan. In this investigation pass, only the b
 - `POST /token` is unauthenticated. It accepts no real user credential and creates a random browser identity and room.
 - The browser has no login/user-selection flow.
 - Every agent session calls `build_mcp_toolsets()` with process-global configuration.
-- Memory is hardcoded to the unauthenticated Cognee endpoint at `http://192.168.86.2:8003/mcp`.
-- The prompt uses one global Cognee session ID (`hope`), so it is not a user isolation boundary.
+- Before the bootstrap implementation, memory was hardcoded to the unauthenticated Cognee endpoint at `http://192.168.86.2:8003/mcp` and used one global Cognee session ID (`hope`).
+- The bootstrap implementation now resolves `shane` from a server-minted room and creates an authenticated MCP client using his profile in `config/users.json`.
 - Local skills use the shared `/skills` directory.
 - Background tasks use a global `/tmp/tasks/events.jsonl` and one global tail cursor. With concurrent rooms, one room can consume another room's task event. This must be fixed before calling the product multi-user safe.
 - Browser transcript history and voice preference use unscoped `localStorage` keys, which can expose one user's local history to the next user on a shared browser.