voipms: API client, POP server list, import numbers

integrations/voipms/client.ts: voipmsApi(url, creds, method, params)
per 06 §5.1 (GET rest.php, 15 s timeout, status "success" or an error
code). The API password is only in the query string: never logged,
never in an error. Known codes get a message for people
(invalid_credentials, ip_not_enabled, ...). getServers and getDids
parse forgivingly; no_did is an empty list.

Routes: GET /api/trunks/:id/voipms-servers, GET and POST
/api/trunks/:id/import-dids. Import adds only numbers voip.ms lists
and that aren't added yet, label from the description, destination
hangup. 400 without API credentials, 502 provider_error with voip.ms's
reason. VOIPMS_API_URL overrides the endpoint for tests.

Web: the trunk form's server list comes from voip.ms once the trunk
has API access, falling back to the built-in list with the reason.
"Import numbers from voip.ms" sits in the trunk form's API section and
the setup wizard's numbers step. Saving a new API password asks
voip.ms again (found in e2e: the old error stayed).

The response shapes are from the 06 spec, not a real account: voip.ms's
API docs need a login. Marked TODO(spec) and (verify) in 06. Tests use
a fake rest.php; e2e m9-t1 too (trunk created off, so nothing registers
to the real voip.ms).

Task: M9-T1

docs/spec/06-voipms.md

@@ -137,3 +137,10 @@ How SelfPhoneNG meets this:
 ## 7. DID import (`POST /api/trunks/:id/import-dids`)
 Calls `getDIDsInfo`. Shows a list with checkboxes in the UI. Imported DIDs get
 destination `{type:'hangup'}` and a warning chip "Not routed yet" until edited.
+
+As built (M9-T1): `integrations/voipms/client.ts`. Assumed shapes (**verify** with a real account,
+voip.ms's API docs need a login): `getServersInfo` → `servers[].server_hostname`; `getDIDsInfo` →
+`dids[].did` (10 digits), `.description`, `.sms_enabled` ("1"); status `no_did` = no numbers;
+`invalid_credentials`, `ip_not_enabled` get their own messages. "Import numbers from voip.ms" is in
+the trunk form's API section and the setup wizard's numbers step; the label comes from the DID's
+description. The server list falls back to the built-in one when the API can't be reached.