trunks: CRUD API, PJSIP trunk config, live registration status, Trunks page

voip.ms-first trunk form with the portal checklist, POP server list
and Test button; passwords are write-only and encrypted. Registration
and IP-auth trunks render per 03 §5.3 (TCP/TLS add ;transport=). The
API refuses a server name that doesn't resolve and transports that are
off, because either makes Asterisk drop the trunk.

Live state: registration from PJSIPShowRegistrationsOutbound (re-read
on every Registry event: two sub-accounts on one server share
Username/Domain), reachability from PJSIPShowEndpoint and trunk
ContactStatus (static contacts aren't in PJSIPShowContacts). Trunk
state is admin-only. Dashboard gets a "Trunks up" card.

trunk-test.ts (in pnpm test:asterisk) runs a fake voip.ms (second
Asterisk): the good trunk registers, a wrong password is Rejected,
qualify reaches the provider; its recorded AMI drives the unit tests.
scripts/e2e/m3-t1.mjs does the same through the UI. The acceptance
check with a real voip.ms sub-account is still to do.

Tests: settle() now awaits an apply instead of a fixed sleep (flaked
under full-suite load).

Task: M3-T1

docs/spec/03-config-generator.md

@@ -307,8 +307,13 @@ type = identify
 endpoint = trunk-{id}
 match = chicago1.voip.ms
 ```
-For `auth_mode = 'ip'`, leave out the `-auth` and `-reg` sections and the `outbound_auth` line.
+For `auth_mode = 'ip'`, leave out the `-auth` and `-reg` sections and the `outbound_auth` line
+(and `from_user` when there is no username).
 Skip disabled trunks entirely.
+For TCP/TLS trunks, `server_uri`, `client_uri` and the AOR `contact` get `;transport=tcp|tls`.
+`identify` resolves `match` when the config loads, and an unresolvable name is an ERROR that drops the
+trunk's identify (verified), so the API refuses a server name that doesn't resolve, and a transport
+that isn't turned on in Settings → SIP.
 
 ## 6. Dialplan: `extensions_selfphoneng.conf`