fix(ai): bind the nvidia GPU exporter to the static LAN IPv4

The 2026-10-22 audit found the live socket on *:9835: #373 bound
node/smartctl in monitoring.nix, but the nvidia exporter enabled in
hardware-nvidia.nix kept the nixpkgs default, so the socket-level
defence-in-depth layer never existed for 9835.

Extend the security-exporters eval check to every enabled exporter's
listenAddress so a future exporter without a bind fails the test.

Assisted-by: DeepSeek Harness (gpt-6-astra)

outputs/x86_64-linux/tests/security-exporters/expected.nix

@@ -1,6 +1,7 @@
 { lib, outputs }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
   ipv4Restricted = true;
+  exportersBoundToLan = true;
   ipv6RestrictedBeforeTrust = true;
   generatedRestrictionsBeforeTrust = true;
   lanRetained = true;

outputs/x86_64-linux/tests/security-exporters/expr.nix

@@ -43,6 +43,18 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
           9835
           9633
         ];
+    # Every enabled exporter must bind this host's static LAN IPv4, not the
+    # nixpkgs default 0.0.0.0 (audit 2026-10-22 found the nvidia exporter wild).
+    exportersBoundToLan =
+      let
+        lanAddr = myvars.networking.hostsAddr.${config.networking.hostName}.ipv4 or null;
+        exporters = [
+          config.services.prometheus.exporters.node
+          config.services.prometheus.exporters.smartctl
+          config.services.prometheus.exporters.nvidia-gpu
+        ];
+      in
+      lib.all (e: !e.enable || e.listenAddress == lanAddr) exporters;
     ipv6RestrictedBeforeTrust = lib.hasInfix ipv6Guard beforeTrust;
     generatedRestrictionsBeforeTrust =
       broadTrustRules != [ ]