Feature 17 review remediation: commit firewall unit, pin image and deps

F17-001: commit the API box's nestquest-api-firewall.service verbatim
as deploy/systemd/nestquest-api-firewall.service (DOCKER-USER RETURN
for 10.60.1.33 and 10.60.1.14, then DROP tcp/8080) and make the
runbook install it from the repository before exposing the API.

F17-002: pin the python:3.12-slim base image by digest in both build
stages, pin api/requirements.txt to the exact versions installed in
the deployed image (direct deps plus transitive closure), and pin the
litestream image by digest in deploy/compose.yaml.

Task: e4a7b18b-5dad-4387-90ac-33588c280824

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.yaml

@@ -56,7 +56,7 @@ services:
   # (uid/gid 999, owner of the volume) with a read-only root filesystem,
   # no privilege escalation and no Linux capabilities.
   litestream:
-    image: litestream/litestream:0.5.17
+    image: litestream/litestream:0.5.17@sha256:4b02b9859a6b6b4087d8b8944e15f7e984bd7957cba322bbeee38b0e27b9656a
     restart: unless-stopped
     command: ["replicate", "-config", "/etc/litestream.yml"]
     user: "999:999"