featurecodes: DND, forwarding, pickup, echo, say-ext; /me settings

Feature codes per 03 §6.13: *78/*79 DND, *72<number>/*73 forward always,
**<ext> directed pickup, *8 group pickup (also as a dialplan line, since
pickupexten only catches a phone's own INVITE), *43 echo test, *65 say
my extension; queue login and intercom stay for M8. SpToggle DND/CFU
update user_runtime_state; a *72 target the user's calling permission
doesn't allow is removed from AstDB, audited (forward_rejected) and sent
to the user as a toast (new private live message). Forward targets are
checked the same way everywhere (services/forwards.ts: an existing
internal number, or an outside number some outbound rule allows them).

GET/PATCH /api/me: DND, cfu/cfb/cfna, voicemail email options and PIN;
PostgreSQL first, then AstDB; AstDB resync on connect now includes DND
and forwards. Web: /me/settings (forwarding, DND, voicemail PIN and
email options), a status card on Home, toasts.

e2e m6-t7 with real phones covers every code, the refused forward toast,
and the settings page reaching AstDB; it found the settings forms losing
"Saved." on remount.

Task: M6-T7

docs/spec/03-config-generator.md

@@ -857,6 +857,10 @@ target against the user's outbound class (04 §5.3). If it isn't allowed, the ap
 deletes the AstDB key, stores nothing, and logs an audit entry. Dialplan also
 limits forwards via `SP_CLASS_<ext>` in `sp-sub-forward`.
 
+As built (M6-T7): everything above except `*45` (queues) and `*80` (intercom), which come with M8.
+`*8` also has a dialplan line (`Pickup()`): `pickupexten` only catches it straight from a phone's
+INVITE. All the sounds used exist in the image (checked).
+
 Sound names like `do-not-disturb`, `call-fwd-unconditional`, `agent-loginok`
 come from the Asterisk core/extra sound packs. If one is missing, swap in
 `beep` and note it in the spec.