security: fix the review leftovers (owner, 08 §6)

- Asterisk doesn't load app_system, func_shell, app_disa, res_agi, app_externalivr.
- Turning two-step sign-in on asks for the password again.
- *97/*98: one voicemail login at a time per phone, 10 an hour (sp-sub-vmlimit).
- /prov: an unknown MAC gets the same 401 as a known one.
- The login limiter sweeps keys past every window.
Also the v1 checklist with the owner's results from 2026-10-21.

asterisk/conf/modules.conf

@@ -51,3 +51,9 @@ noload = chan_websocket.so
 noload = res_adsi.so
 noload = app_getcpeid.so
 noload = app_adsiprog.so
+; can run host commands; nothing of ours uses them, but a dialplan injection would reach for them (08 §6)
+noload = app_system.so
+noload = func_shell.so
+noload = app_disa.so
+noload = res_agi.so
+noload = app_externalivr.so