ivrs: digital receptionist with keypad grid, SoundPicker, golden case

/api/ivrs CRUD: greeting and wrong-key sounds must be prompts, every
option destination must exist (an option may point at its own menu),
keys unique; delete drops the menu's own options before checking
references, inside a transaction so a refused delete keeps them. The
generator renders sp-ivr-{id} per 03 §6.9 (Background greeting,
WaitExten, keys sorted, i/t retry then give up, include sp-local-numbers
for direct dial), adds the number to sp-local-numbers, and destApp sends
ivr destinations there. Golden case ivr (incl. # and self-reference).

Web: Digital receptionist page with a 3x4 keypad grid (pick a key, then
its destination or "unused"), SoundPicker (pick, play, upload new right
in the form), DestinationPicker gains "Digital receptionist" and a shared
target source; useDescribeDestination labels unsaved keys.

e2e m6-t3: menu built in the UI, the greeting plays, keys 1/2 ring the
right phones, a wrong key plays pbx-invalid and repeats the greeting.

Task: M6-T3

apps/api/src/generator/sanitize.ts

@@ -18,6 +18,8 @@ export const digits = check(/^[0-9]+$/, 'digits', 32);
 export const dialable = check(/^[0-9*#+]+$/, 'dialable', 32);
 /** Outbound route patterns. */
 export const pattern = check(/^[0-9XZN.![\]-]+$/, 'pattern', 32);
+/** One IVR key. */
+export const ivrDigit = check(/^[0-9*#]$/, 'ivr digit', 1);
 /** Sound file names for Playback/Background. */
 export const sound = check(/^[a-z0-9/_-]+$/, 'sound', 100);
 /** Context-name parts (uuids), MOH class names. */