softphone: SIP.js engine, /api/me/webrtc, minimal dock

GET /api/me/webrtc returns the <ext>-web identity, WebSocket URL
(WEBRTC_WS_URL overrides wss://PUBLIC_HOSTNAME/ws) and STUN/TURN servers.
SoftphoneEngine wraps SIP.js 0.21.2: register with backoff reconnect,
call, answer, decline, hang up, remote audio. A minimal dock on /me
enables it (asks for the microphone on the click) and dials/answers;
M5-T2 grows it into the full panel.

Generator: ice_host_candidates keeps the LAN address
(include_local_address), so LAN browsers don't need hairpin NAT, and -web
endpoints set from_domain = selfphoneng.invalid because SIP.js drops
INVITEs whose From host starts with a digit (Docker/VPS hostnames).

e2e m5-t1 (Docker): browser registers as 170-web and has two-way audio
with a baresip phone both ways. The LAN and hotspot check on the owner's
server is still open (roadmap note).

Task: M5-T1

docs/spec/03-config-generator.md

@@ -100,10 +100,12 @@ icesupport = yes
 stunaddr = {network.stunServer}          ; omit line when null
 {if network.lanIp and network.publicIp}
 [ice_host_candidates]
-{network.lanIp} => {network.publicIp}
+{network.lanIp} => {network.publicIp},include_local_address
 {/if}
 ```
 (`network.lanIp` is the server's own LAN address, see `02-data-model.md` §3.)
+`include_local_address` keeps the LAN host candidate next to the public one. Without it a browser
+on the LAN only gets the public address and needs hairpin NAT, which many routers lack (M5-T1).
 
 ## 5. `pjsip_selfphoneng.conf`
 
@@ -227,6 +229,8 @@ disallow = all
 allow = g722,ulaw                  ; NO opus: no open source transcoder in Asterisk (AGENTS rule 4)
 auth = 101-web-auth
 aors = 101-web
+from_domain = selfphoneng.invalid  ; else the From host is the machine's hostname; SIP.js drops
+                                   ; INVITEs whose host label starts with a digit (M5-T1)
 callerid = "Dan Doe" <101>
 mailboxes = 101@default
 mwi_subscribe_replaces_unsolicited = yes

docs/spec/09-roadmap.md

@@ -158,6 +158,11 @@ Legend: 📖 read · 🔨 build · ✅ done when
 **M5-T1** `/api/me/webrtc`, reverse-proxy `/ws` (Caddy + nginx example), engine (05 §5.2).
 ✅ The browser registers (`pjsip show contacts` shows 101-web), and calls between browser and desk phone have two-way audio, both on the LAN and from a phone hotspot outside the LAN.
 
+> **⚠ Open real-network check (M5-T1).** Verified in Docker only (`scripts/e2e/m5-t1.mjs`:
+> register, browser ↔ softphone both directions, two-way audio). Still to do on the owner's
+> server behind the reverse proxy: a browser on the LAN and one on a phone hotspot, each with
+> two-way audio to a phone.
+
 **M5-T2** Dock UI, incoming dialog, hold/mute/DTMF, blind + attended transfer, one-tab leader election, audio device selection, notifications.
 ✅ A manual test script in `apps/web/TESTING.md` (12 steps) passes in Chrome and Firefox.