security: fix the review leftovers (owner, 08 §6)

- Asterisk doesn't load app_system, func_shell, app_disa, res_agi, app_externalivr.
- Turning two-step sign-in on asks for the password again.
- *97/*98: one voicemail login at a time per phone, 10 an hour (sp-sub-vmlimit).
- /prov: an unknown MAC gets the same 401 as a known one.
- The login limiter sweeps keys past every window.
Also the v1 checklist with the owner's results from 2026-10-21.

apps/api/src/generator/dialplan/static.ts

@@ -112,14 +112,35 @@ exten => _X!,1,Answer()                ; X! also matches "0" (caller unknown)
  same => n,SayDigits(\${EXTEN})
  same => n,Hangup()
 
+; ─── Voicemail logins (*97, *98) from a phone: one at a time and 10 an hour, 3 PIN tries each
+; (voicemail.conf maxlogins), so a phone can't run through the PINs (08 §6). Returns "ok".
+[sp-sub-vmlimit]
+exten => s,1,Set(GROUP(spvm)=\${SP_EXT})
+ same => n,GotoIf($[\${GROUP_COUNT(\${SP_EXT}@spvm)} > 1]?no)
+ same => n,Set(LOCAL(H)=\${STRFTIME(\${EPOCH},UTC,%Y%m%d%H)})
+ same => n,Set(LOCAL(V)=\${DB(SP/VMLOGIN/\${SP_EXT})})
+ same => n,Set(LOCAL(N)=\${IF($["\${CUT(V,:,1)}" = "\${H}"]?\${CUT(V,:,2)}:0)})
+ same => n,GotoIf($[\${N} >= 10]?no)
+ same => n,Set(DB(SP/VMLOGIN/\${SP_EXT})=\${H}:$[\${N} + 1])
+ same => n,Return(ok)
+ same => n(no),Return()
+
 ; ─── Feature codes (03 §6.13).
 [sp-featurecodes]
 exten => *97,1,Answer()                                     ; my voicemail
+ same => n,Gosub(sp-sub-vmlimit,s,1)
+ same => n,GotoIf($["\${GOSUB_RETVAL}" != "ok"]?full)
  same => n,VoiceMailMain(\${SP_EXT}@default)
  same => n,Hangup()
+ same => n(full),Playback(an-error-has-occurred)
+ same => n,Hangup()
 exten => *98,1,Answer()                                     ; any voicemail (asks mailbox)
+ same => n,Gosub(sp-sub-vmlimit,s,1)
+ same => n,GotoIf($["\${GOSUB_RETVAL}" != "ok"]?full)
  same => n,VoiceMailMain(@default)
  same => n,Hangup()
+ same => n(full),Playback(an-error-has-occurred)
+ same => n,Hangup()
 exten => *78,1,Answer()                                     ; DND on
  same => n,Set(DB(SP/DND/\${SP_EXT})=1)
  same => n,UserEvent(SpToggle,Key: DND,Ext: \${SP_EXT},Value: 1)