conferences: rooms with PIN and admin PIN, per-room limits, recording

/api/conferences CRUD: PINs stored encrypted, shown to admins (they hand
them out), never in the audit log; an admin PIN needs a different room
PIN (checked against the stored values on PATCH). The generator renders
sp-conf-{id} per 03 §6.11 (PIN prompt, 3 tries, admin PIN joins with
sp_admin_user), the number in sp-local-numbers and destApp conference.

Two changes from the spec's snippet, both found with real calls and
written back into 03:
- Set(CONFBRIDGE(bridge,max_members)) is ignored once ConfBridge()
  names a bridge profile: a 4th caller got into a room of 3. Each room
  now has its own [sp_room_<n>](default_bridge) profile in
  confbridge_selfphoneng.conf.
- A recorded room runs sp-sub-record on each caller's leg (just before
  ConfBridge) instead of record_conference, so the files are ordinary
  call recordings: call history, Recordings page, retention.

Web: Conference rooms page (list, drawer form), "Conference room" in
the DestinationPicker. Golden case conferences. e2e m8-t3: room built
in the UI, wrong PIN refused and asked again, admin PIN joins with
flags AM, a 4th caller turned away, recordings listed, and a no-PIN
room with two desk phones.

Task: M8-T3

apps/api/src/generator/index.ts

@@ -20,6 +20,7 @@ import { renderEmergency } from './dialplan/emergency.ts';
 import { renderRingGroups } from './dialplan/ringgroups.ts';
 import { renderQueueDialplan } from './dialplan/queues.ts';
 import { renderQueues } from './queues.ts';
+import { renderConfbridge, renderConferences } from './dialplan/conferences.ts';
 import { renderIvrs } from './dialplan/ivrs.ts';
 import { renderTimeConditions } from './dialplan/timeconditions.ts';
 import { renderAnnouncements } from './dialplan/announcements.ts';
@@ -52,12 +53,14 @@ const BODIES: Partial<Record<GeneratedFileName, (snap: Snapshot) => string>> = {
   'extensions_globals_selfphoneng.conf': renderGlobals,
   'voicemail_selfphoneng.conf': renderVoicemail,
   'queues_selfphoneng.conf': renderQueues,
+  'confbridge_selfphoneng.conf': renderConfbridge,
   'extensions_selfphoneng.conf': (snap) =>
     [
       STATIC_DIALPLAN,
       renderLocalNumbers(snap),
       renderRingGroups(snap),
       renderQueueDialplan(snap),
+      renderConferences(snap),
       renderIvrs(snap),
       renderTimeConditions(snap),
       renderAnnouncements(snap),