live: listen, whisper and barge on calls in progress

POST /api/live/calls/:linkedid/spy {mode} per 04 §7.3: rings the
admin's desk phone (409 if it isn't connected, 400 without an
extension) and, when they answer, runs ChanSpy on the call's first
user leg (never a trunk or Local channel, never the admin's own),
which for an inbound or queue call is the agent. Options qE / qEw /
qEB: no beep or name, the spy leg ends with the call, whisper to that
user only, or barge (both sides hear). Audited as call_spy.

Dashboard: Listen / Whisper / Barge on talking calls with a user on
them, and "your desk phone is ringing" once sent. The spy leg shows as
its own call; its Hang up stops listening.

e2e m10-t4: 380 calls 381, the admin's 382 runs ChanSpy with each
mode's options, and the barge leg ends with the call. The roadmap
records that M10's milestone check (real Yealink/Grandstream, Linphone
scanning the QR) waits for hardware the owner doesn't have yet.

Task: M10-T4

docs/spec/04-backend-api.md

@@ -419,7 +419,7 @@ Reports, history, system:
 | GET | `/api/live` | WebSocket (§5.2) |
 | POST | `/api/live/calls/:linkedid/hangup` | admin |
 | POST | `/api/live/calls/:linkedid/transfer` | admin `{target}` → AMI `Redirect` of the external party's channel to `sp-local-numbers,<target>,1` |
-| POST | `/api/live/calls/:linkedid/spy` | admin `{mode: 'listen'|'whisper'|'barge'}` → Originate to admin's ext running `ChanSpy(<channel>,q{''|w|B})` (M10) |
+| POST | `/api/live/calls/:linkedid/spy` | admin `{mode: 'listen'|'whisper'|'barge'}` → Originate to admin's ext running `ChanSpy(<channel>,q{''|w|B})` (M10). As built (M10-T4): rings the admin's **desk** phone (`PJSIP/<ext>`, 409 if it isn't connected; 400 without an extension); spies on the call's first user leg (`PJSIP/<n>` or `-web`, not the admin's own, never a trunk or Local channel), which for an inbound or queue call is the agent; options `qE`, `qEw`, `qEB` (`E`: the spy leg ends with the call). Audited as `call_spy`. The spy leg shows on the dashboard as its own call ("Listen 101"); hanging it up stops listening |
 | GET | `/healthz` | unauthenticated; 200 if DB ok, AMI connected, else 503 with JSON reasons |
 
 SMS (06 §5): `GET /api/sms/threads`, `GET /api/sms/threads/:didId/:remoteNumber`,

docs/spec/09-roadmap.md

@@ -229,6 +229,7 @@ As built: done against a fake voip.ms API. **Open:** check the response shapes w
 **M10-T2** Yealink + Grandstream templates + phonebook XML + timezone table (07 §3).
 **M10-T3** Linphone QR provisioning (07 §5) + "Set up a phone app" page.
 **M10-T4** Spy/whisper/barge (04 §7.3).
+As built: all four tasks done and tested with simulated phones (`scripts/e2e/m10-t1…t4.mjs`). **Open:** the milestone check below needs a real Yealink (and a Grandstream for its keys) and the Linphone app scanning the QR; the owner has neither yet (2026-10-19). Vendor key names stay (verify per model) until then.
 ✅ A factory-reset Yealink pointed at the URL registers with the right name and BLF keys. Linphone on a phone registers by scanning the QR.
 
 ---