security: review fixes (dialed-number filter, browser endpoint ACL, IVR direct dial, …)

The 08 §1 threat table checked line by line against the code, plus a review by a separate agent
that hadn't written it. Findings were reproduced with a failing test before each fix:

- Critical: "011…,4" turned the route's Goto into Goto(sp-route-…,011…,4,1), starting past the
  class check, so any extension could call abroad. FILTER on the dialed number (also stops "&"
  adding a Dial target). trunk-test.ts proves it.
- High: -web endpoints (desk phone's password, any transport) skipped the phone ACL; now
  127.0.0.1 only when it's on. call-test.ts: UDP refused, WebSocket from 127.0.0.1 registers.
- IVR direct dial no longer reaches paging groups or parked calls (sp-ivr-direct).
- Trunks identify_by = ip: a From of trunk-<id> from anywhere no longer rings phones.
- .dockerignore is an allowlist, so the public source archive can't pick up stray files.
- CSRF check on the matched route (/%61pi/… got around it); Linphone tokens masked in logs;
  /api/live checks Origin and re-checks the session; *45/** filter digits; pg_dump password in
  the environment; more webhook ranges blocked.

The review and what's left for the owner are in 08 §6.

Task: M11-T8

apps/api/src/auth/sessions.ts

@@ -44,8 +44,11 @@ export async function createSession(
   return token;
 }
 
-/** Resolves a cookie token to its active user, sliding the expiry when under 7 days are left. */
-export async function getSessionUser(db: Db, token: string) {
+/**
+ * Resolves a cookie token to its active user, sliding the expiry when under 7 days are left
+ * (not for the live socket's re-checks: an open dashboard alone doesn't keep a session going).
+ */
+export async function getSessionUser(db: Db, token: string, slide = true) {
   const id = sha256(token);
   const [row] = await db
     .select({ expiresAt: sessions.expiresAt, user: users })
@@ -54,7 +57,7 @@ export async function getSessionUser(db: Db, token: string) {
     .where(and(eq(sessions.id, id), gt(sessions.expiresAt, new Date()), eq(users.isActive, true)));
   if (!row) return null;
   let extended = false;
-  if (row.expiresAt.getTime() - Date.now() < EXTEND_BELOW) {
+  if (slide && row.expiresAt.getTime() - Date.now() < EXTEND_BELOW) {
     await db
       .update(sessions)
       .set({ expiresAt: new Date(Date.now() + LIFETIME) })