softphone: SIP.js engine, /api/me/webrtc, minimal dock

GET /api/me/webrtc returns the <ext>-web identity, WebSocket URL
(WEBRTC_WS_URL overrides wss://PUBLIC_HOSTNAME/ws) and STUN/TURN servers.
SoftphoneEngine wraps SIP.js 0.21.2: register with backoff reconnect,
call, answer, decline, hang up, remote audio. A minimal dock on /me
enables it (asks for the microphone on the click) and dials/answers;
M5-T2 grows it into the full panel.

Generator: ice_host_candidates keeps the LAN address
(include_local_address), so LAN browsers don't need hairpin NAT, and -web
endpoints set from_domain = selfphoneng.invalid because SIP.js drops
INVITEs whose From host starts with a digit (Docker/VPS hostnames).

e2e m5-t1 (Docker): browser registers as 170-web and has two-way audio
with a baresip phone both ways. The LAN and hotspot check on the owner's
server is still open (roadmap note).

Task: M5-T1

apps/api/test/me-voicemail.test.ts

@@ -5,6 +5,7 @@ import { mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import type { LightMyRequestResponse } from 'fastify';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { setSetting } from '../src/services/settings.ts';
 import { hasTestDb } from './db.ts';
 import { ADMIN, H, createTestApp } from './app.ts';
 
@@ -143,6 +144,21 @@ describe.skipIf(!hasTestDb)('/api/me/voicemail and greetings', () => {
     t.ami.connected = true;
   });
 
+  it('webrtc: creds for <ext>-web with ICE servers; 404 without an extension', async () => {
+    await setSetting(t.db, 'network.stunServer', 'stun.example.org:3478');
+    const r = await dan('GET', '/api/me/webrtc');
+    expect(r.statusCode).toBe(200);
+    expect(r.json()).toMatchObject({
+      wsUrl: 'wss://pbx.test/ws',
+      sipUri: 'sip:101-web@pbx.test',
+      authUser: '101-web',
+      displayName: 'Dan Doe',
+      iceServers: [{ urls: 'stun:stun.example.org:3478' }],
+    });
+    expect(r.json().password).toMatch(/^[A-Za-z0-9]{16,}$/);
+    expect((await eve('GET', '/api/me/webrtc')).statusCode).toBe(404);
+  });
+
   it.skipIf(!hasFfmpeg)('greetings: upload any audio → 8 kHz wav; play; delete', async () => {
     expect((await dan('GET', '/api/me/greetings')).json()).toEqual({
       unavail: false,