the account token is readable by every daemon in the robot group, not only mediad #229

remote-access-design.md §2.5 and §2.6 say the credential at /etc/robot/hf-token is 0640 root:robot, so only root and mediad can read it, and updater/src/account.rs puts it in that group on purpose. the units say something else. robot is the socket group, it is how any client reaches a daemon's 0660 socket at all, so btd.service, padd.service and tofd.service all carry SupplementaryGroups=robot, and install.sh and provision.sh add the operator's own account to it as well. so the owner's hugging face bearer token, which §7 says can still write to their repositories, is readable by the bluetooth daemon that parses bytes from anyone in radio range, by the gamepad daemon that the repository describes as the process whose whole value is having no privileged access, by the depth sensor daemon, and by every shell user on the board.

none of those is a known way in, and this is a boundary drawn in the wrong place rather than a break. but the design spent a section on this file's mode precisely so that the boundary would be the file's, and the group it chose is the one that means everybody.

the fix is a group of its own with mediad as its only member, created by the sysusers.d files the release already ships, granted in mediad.service, and named in account.rs. i ran the two sysusers files through systemd-sysusers on a debian trixie root and got robot-account:x:998:mediad. branch coming.

on main at 5984efb.