softphone: SIP.js engine, /api/me/webrtc, minimal dock

GET /api/me/webrtc returns the <ext>-web identity, WebSocket URL
(WEBRTC_WS_URL overrides wss://PUBLIC_HOSTNAME/ws) and STUN/TURN servers.
SoftphoneEngine wraps SIP.js 0.21.2: register with backoff reconnect,
call, answer, decline, hang up, remote audio. A minimal dock on /me
enables it (asks for the microphone on the click) and dials/answers;
M5-T2 grows it into the full panel.

Generator: ice_host_candidates keeps the LAN address
(include_local_address), so LAN browsers don't need hairpin NAT, and -web
endpoints set from_domain = selfphoneng.invalid because SIP.js drops
INVITEs whose From host starts with a digit (Docker/VPS hostnames).

e2e m5-t1 (Docker): browser registers as 170-web and has two-way audio
with a baresip phone both ways. The LAN and hotspot check on the owner's
server is still open (roadmap note).

Task: M5-T1

apps/api/src/routes/me.ts

@@ -6,7 +6,14 @@ import { join } from 'node:path';
 import { and, desc, eq, isNull } from 'drizzle-orm';
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
-import { GREETINGS, type ListResponse, type VoicemailDto } from '@selfphoneng/shared';
+import {
+  GREETINGS,
+  type ListResponse,
+  type VoicemailDto,
+  type WebRtcCreds,
+} from '@selfphoneng/shared';
+import { decrypt } from '../crypto/secrets.ts';
+import { getSetting } from '../services/settings.ts';
 import { requireAuth } from '../auth/guards.ts';
 import { extensions, voicemailMessages } from '../db/schema.ts';
 import { badRequest, HttpError, notFound } from '../errors.ts';
@@ -64,6 +71,30 @@ export async function meRoutes(app: FastifyInstance) {
     await app.voicemail.scan(ext);
   }
 
+  /** The browser softphone's identity: <ext>-web, same SIP password as the desk phone (03 §5.2). */
+  app.get('/api/me/webrtc', async (req): Promise<WebRtcCreds> => {
+    const [ext] = await db.select().from(extensions).where(eq(extensions.userId, req.user!.id));
+    if (!ext) throw notFound("You don't have an extension yet. Ask your admin.");
+    if (!ext.webrtcEnabled)
+      throw notFound('The browser softphone is turned off for your extension');
+    const host = app.config.PUBLIC_HOSTNAME;
+    const stun = await getSetting(db, 'network.stunServer');
+    const turn = await getSetting(db, 'network.turn');
+    return {
+      wsUrl: app.config.WEBRTC_WS_URL ?? `wss://${host}/ws`,
+      sipUri: `sip:${ext.number}-web@${host}`,
+      authUser: `${ext.number}-web`,
+      password: decrypt(ext.sipPasswordEnc),
+      displayName: ext.name,
+      iceServers: [
+        ...(stun ? [{ urls: `stun:${stun}` }] : []),
+        ...(turn
+          ? [{ urls: turn.url, username: turn.username, credential: decrypt(turn.credentialEnc) }]
+          : []),
+      ],
+    };
+  });
+
   app.get('/api/me/voicemail', async (req): Promise<ListResponse<VoicemailDto>> => {
     const ext = await myExtension(req.user!.id);
     const rows = await db