trunks: CRUD API, PJSIP trunk config, live registration status, Trunks page

voip.ms-first trunk form with the portal checklist, POP server list
and Test button; passwords are write-only and encrypted. Registration
and IP-auth trunks render per 03 §5.3 (TCP/TLS add ;transport=). The
API refuses a server name that doesn't resolve and transports that are
off, because either makes Asterisk drop the trunk.

Live state: registration from PJSIPShowRegistrationsOutbound (re-read
on every Registry event: two sub-accounts on one server share
Username/Domain), reachability from PJSIPShowEndpoint and trunk
ContactStatus (static contacts aren't in PJSIPShowContacts). Trunk
state is admin-only. Dashboard gets a "Trunks up" card.

trunk-test.ts (in pnpm test:asterisk) runs a fake voip.ms (second
Asterisk): the good trunk registers, a wrong password is Rejected,
qualify reaches the provider; its recorded AMI drives the unit tests.
scripts/e2e/m3-t1.mjs does the same through the UI. The acceptance
check with a real voip.ms sub-account is still to do.

Tests: settle() now awaits an apply instead of a fixed sleep (flaked
under full-suite load).

Task: M3-T1

apps/web/src/api/client.ts

@@ -8,6 +8,10 @@ import type {
   ListResponse,
   NumberKind,
   SipCredentials,
+  TrunkCreate,
+  TrunkDto,
+  TrunkTestResult,
+  TrunkUpdate,
   UserCreate,
   UserDto,
   UserUpdate,
@@ -74,3 +78,11 @@ export const extensionsApi = {
   nextNumber: (kind: NumberKind) =>
     api<{ number: string | null }>('GET', `/api/numbering/next?kind=${kind}`).then((r) => r.number),
 };
+
+export const trunksApi = {
+  list: () => api<ListResponse<TrunkDto>>('GET', '/api/trunks').then((r) => r.items),
+  create: (t: TrunkCreate) => api<TrunkDto>('POST', '/api/trunks', t),
+  update: (id: string, t: TrunkUpdate) => api<TrunkDto>('PATCH', `/api/trunks/${id}`, t),
+  remove: (id: string) => api<{ ok: true }>('DELETE', `/api/trunks/${id}`),
+  test: (id: string) => api<TrunkTestResult>('POST', `/api/trunks/${id}/test`),
+};