softphone: SIP.js engine, /api/me/webrtc, minimal dock

GET /api/me/webrtc returns the <ext>-web identity, WebSocket URL
(WEBRTC_WS_URL overrides wss://PUBLIC_HOSTNAME/ws) and STUN/TURN servers.
SoftphoneEngine wraps SIP.js 0.21.2: register with backoff reconnect,
call, answer, decline, hang up, remote audio. A minimal dock on /me
enables it (asks for the microphone on the click) and dials/answers;
M5-T2 grows it into the full panel.

Generator: ice_host_candidates keeps the LAN address
(include_local_address), so LAN browsers don't need hairpin NAT, and -web
endpoints set from_domain = selfphoneng.invalid because SIP.js drops
INVITEs whose From host starts with a digit (Docker/VPS hostnames).

e2e m5-t1 (Docker): browser registers as 170-web and has two-way audio
with a baresip phone both ways. The LAN and hotspot check on the owner's
server is still open (roadmap note).

Task: M5-T1

apps/web/src/api/client.ts

@@ -25,6 +25,7 @@ import type {
   UserDto,
   UserUpdate,
   VoicemailDto,
+  WebRtcCreds,
   Warning,
 } from '@selfphoneng/shared';
 
@@ -145,6 +146,7 @@ export const systemApi = {
 };
 
 export const meApi = {
+  webrtc: () => api<WebRtcCreds>('GET', '/api/me/webrtc'),
   voicemail: () => api<ListResponse<VoicemailDto>>('GET', '/api/me/voicemail').then((r) => r.items),
   audioUrl: (id: string, download = false) =>
     `/api/me/voicemail/${id}/audio${download ? '?download=1' : ''}`,