trunks: CRUD API, PJSIP trunk config, live registration status, Trunks page

voip.ms-first trunk form with the portal checklist, POP server list
and Test button; passwords are write-only and encrypted. Registration
and IP-auth trunks render per 03 §5.3 (TCP/TLS add ;transport=). The
API refuses a server name that doesn't resolve and transports that are
off, because either makes Asterisk drop the trunk.

Live state: registration from PJSIPShowRegistrationsOutbound (re-read
on every Registry event: two sub-accounts on one server share
Username/Domain), reachability from PJSIPShowEndpoint and trunk
ContactStatus (static contacts aren't in PJSIPShowContacts). Trunk
state is admin-only. Dashboard gets a "Trunks up" card.

trunk-test.ts (in pnpm test:asterisk) runs a fake voip.ms (second
Asterisk): the good trunk registers, a wrong password is Rejected,
qualify reaches the provider; its recorded AMI drives the unit tests.
scripts/e2e/m3-t1.mjs does the same through the UI. The acceptance
check with a real voip.ms sub-account is still to do.

Tests: settle() now awaits an apply instead of a fixed sleep (flaked
under full-suite load).

Task: M3-T1

apps/api/src/generator/sanitize.ts

@@ -24,6 +24,12 @@ export const sound = check(/^[a-z0-9/_-]+$/, 'sound', 100);
 export const ident = check(/^[a-z0-9-]+$/, 'ident', 64);
 /** Generated SIP passwords. */
 export const secret = check(/^[A-Za-z0-9]+$/, 'secret', 64);
+/** Trunk usernames (voip.ms sub-accounts like 123456_pbx). */
+export const sipUser = check(/^[A-Za-z0-9_.-]+$/, 'sip user', 64);
+/** Passwords typed by an admin (trunks): no ';' (comment), no line breaks, no edge spaces. */
+export const typedSecret = check(/^[^\s;](?:[^\r\n;]*[^\s;])?$/, 'password', 128);
+/** Codec names. */
+export const codec = check(/^(?:ulaw|alaw|g722)$/, 'codec', 4);
 /** Voicemail / conference PINs. */
 export const pin = check(/^[0-9]{4,10}$/, 'pin', 10);
 /** Trunk server host: a hostname or an IPv4 address. */