fix(ai): bind the nvidia GPU exporter to the static LAN IPv4

The 2026-10-22 audit found the live socket on *:9835: #373 bound
node/smartctl in monitoring.nix, but the nvidia exporter enabled in
hardware-nvidia.nix kept the nixpkgs default, so the socket-level
defence-in-depth layer never existed for 9835.

Extend the security-exporters eval check to every enabled exporter's
listenAddress so a future exporter without a bind fails the test.

Assisted-by: DeepSeek Harness (gpt-6-astra)

hosts/idols-ai/hardware-nvidia.nix

@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  myvars,
   ...
 }:
 {
@@ -72,7 +73,12 @@
   # GPU monitoring: CUDA btop, nvtop, and the community nvidia_gpu_exporter.
   modules.btop.package = pkgs.btop-cuda;
   environment.systemPackages = [ pkgs.nvtopPackages.full ];
-  services.prometheus.exporters.nvidia-gpu.enable = true;
+  # LAN-bound like node/smartctl in modules/nixos/base/monitoring.nix: the
+  # socket must not exist on tailscale0/br0 even if the firewall regresses.
+  services.prometheus.exporters.nvidia-gpu = {
+    enable = true;
+    listenAddress = myvars.networking.hostsAddr.ai.ipv4;
+  };
 
   services.sunshine.settings = {
     max_bitrate = 20000; # in Kbps