softphone: SIP.js engine, /api/me/webrtc, minimal dock

GET /api/me/webrtc returns the <ext>-web identity, WebSocket URL
(WEBRTC_WS_URL overrides wss://PUBLIC_HOSTNAME/ws) and STUN/TURN servers.
SoftphoneEngine wraps SIP.js 0.21.2: register with backoff reconnect,
call, answer, decline, hang up, remote audio. A minimal dock on /me
enables it (asks for the microphone on the click) and dials/answers;
M5-T2 grows it into the full panel.

Generator: ice_host_candidates keeps the LAN address
(include_local_address), so LAN browsers don't need hairpin NAT, and -web
endpoints set from_domain = selfphoneng.invalid because SIP.js drops
INVITEs whose From host starts with a digit (Docker/VPS hostnames).

e2e m5-t1 (Docker): browser registers as 170-web and has two-way audio
with a baresip phone both ways. The LAN and hotspot check on the owner's
server is still open (roadmap note).

Task: M5-T1

scripts/e2e/README.md

@@ -57,3 +57,10 @@ same setup: it adds a user with extension 160 and a baresip phone with the mwi m
 messages, then as that user in the browser plays one (marks it read) and deletes another, each
 time checking the phone's MWI goes off within 5 s. It records the "no answer" greeting with a
 fake microphone and checks a caller hears it.
+
+`m5-t1.mjs <baseUrl> <adminEmail> <adminPassword> <shotsDir>` is the M5-T1 check in Docker: start
+the api with `WEBRTC_WS_URL=ws://127.0.0.1:18088/ws`. `m2-live.mjs up` publishes Asterisk's HTTP
+server on 127.0.0.1:18088 and RTP 10000–10019/udp. The script sets LAN IP = the container and public
+IP = 127.0.0.1 (so ICE offers 127.0.0.1), restarts telephony, then signs in as a new user, enables
+the softphone with a fake microphone, and checks two-way audio to a baresip phone (171) in both
+directions.