security: review fixes (dialed-number filter, browser endpoint ACL, IVR direct dial, …)

The 08 §1 threat table checked line by line against the code, plus a review by a separate agent
that hadn't written it. Findings were reproduced with a failing test before each fix:

- Critical: "011…,4" turned the route's Goto into Goto(sp-route-…,011…,4,1), starting past the
  class check, so any extension could call abroad. FILTER on the dialed number (also stops "&"
  adding a Dial target). trunk-test.ts proves it.
- High: -web endpoints (desk phone's password, any transport) skipped the phone ACL; now
  127.0.0.1 only when it's on. call-test.ts: UDP refused, WebSocket from 127.0.0.1 registers.
- IVR direct dial no longer reaches paging groups or parked calls (sp-ivr-direct).
- Trunks identify_by = ip: a From of trunk-<id> from anywhere no longer rings phones.
- .dockerignore is an allowlist, so the public source archive can't pick up stray files.
- CSRF check on the matched route (/%61pi/… got around it); Linphone tokens masked in logs;
  /api/live checks Origin and re-checks the session; *45/** filter digits; pg_dump password in
  the environment; more webhook ranges blocked.

The review and what's left for the owner are in 08 §6.

Task: M11-T8

apps/api/src/generator/dialplan/static.ts

@@ -118,7 +118,8 @@ exten => *73,1,Answer()                                     ; cancel forward alw
  same => n,UserEvent(SpToggle,Key: CFU,Ext: \${SP_EXT},Value: )
  same => n,Playback(call-fwd-unconditional&de-activated)
  same => n,Hangup()
-exten => _**X.,1,PickupChan(PJSIP/\${EXTEN:2}-&PJSIP/\${EXTEN:2}-web-)   ; directed pickup **101
+exten => _**X.,1,Set(T=\${FILTER(0-9,\${EXTEN:2})})        ; digits only: "&" or "," would add arguments
+ same => n,PickupChan(PJSIP/\${T}-&PJSIP/\${T}-web-)           ; directed pickup **101
  same => n,Hangup()
 ; *8 group pickup: features.conf pickupexten catches it straight from a phone's INVITE; this
 ; line covers calls that reach *8 through the dialplan. Uses named_pickup_group.
@@ -133,7 +134,7 @@ exten => *65,1,Answer()                                     ; say my extension
  same => n,SayDigits(\${SP_EXT})
  same => n,Hangup()
 exten => _*45X.,1,Answer()                                  ; *45<queue> toggle queue login
- same => n,Set(Q=\${EXTEN:3})
+ same => n,Set(Q=\${FILTER(0-9,\${EXTEN:3})})
  same => n,Set(K=SP/QPAUSE/\${Q}/\${SP_EXT})
  same => n,GotoIf($["\${DB(\${K})}" = "1"]?login)
  same => n,PauseQueueMember(\${Q},Local/\${SP_EXT}@sp-queue-member/n)