The go2rtc API is unauthenticated and echoes producer URLs, so
GET /api/streams handed out the camera's RTSP password to anything
on the LAN. Bind api/rtsp/webrtc to 127.0.0.1 and add an `isolated`
device flag that drops the camera in the forward chain.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
