trunks: CRUD API, PJSIP trunk config, live registration status, Trunks page

voip.ms-first trunk form with the portal checklist, POP server list
and Test button; passwords are write-only and encrypted. Registration
and IP-auth trunks render per 03 §5.3 (TCP/TLS add ;transport=). The
API refuses a server name that doesn't resolve and transports that are
off, because either makes Asterisk drop the trunk.

Live state: registration from PJSIPShowRegistrationsOutbound (re-read
on every Registry event: two sub-accounts on one server share
Username/Domain), reachability from PJSIPShowEndpoint and trunk
ContactStatus (static contacts aren't in PJSIPShowContacts). Trunk
state is admin-only. Dashboard gets a "Trunks up" card.

trunk-test.ts (in pnpm test:asterisk) runs a fake voip.ms (second
Asterisk): the good trunk registers, a wrong password is Rejected,
qualify reaches the provider; its recorded AMI drives the unit tests.
scripts/e2e/m3-t1.mjs does the same through the UI. The acceptance
check with a real voip.ms sub-account is still to do.

Tests: settle() now awaits an apply instead of a fixed sleep (flaked
under full-suite load).

Task: M3-T1

apps/api/src/index.ts

@@ -40,7 +40,7 @@ const generator = createGenerator({
       type: 'system.configApplied',
       data: { ok: r.ok, error: r.error, restartRequired: r.restartRequired },
     });
-    void live.loadExtensions().catch((err) => app.log.error({ err }, 'live reload failed'));
+    void live.loadFromDb().catch((err) => app.log.error({ err }, 'live reload failed'));
   },
 });
 app.decorate('generator', generator);
@@ -57,7 +57,7 @@ if (admin === 'created')
   app.log.info({ email: config.INITIAL_ADMIN_EMAIL }, 'initial admin created');
 await app.listen({ host: '127.0.0.1', port: config.API_PORT });
 
-await live.loadExtensions();
+await live.loadFromDb();
 // Every (re)connect: Asterisk may have restarted, so push the full config again, then read its
 // state (after the apply, so hints for new extensions exist). TODO(M6): sync AstDB first (04 §5.5).
 ami.on('connected', () => {