live: AMI-fed live state, /api/live WebSocket, dashboard and status dots

LiveState loads extension states and registered devices from Asterisk on
every AMI connect and follows ExtensionStatus/ContactStatus; the hub sends
a snapshot then deltas batched every 250 ms (devices for admins only),
pings every 30 s and closes unauthenticated sockets with 4401. The web UI
keeps one reconnecting socket in a zustand store, shows a Reconnecting
banner, a Dashboard (online, on a call, telephony engine) and status dots.

Fix: Asterisk 24 has no 'pjsip reload'; reload with
'module reload res_pjsip.so'. AMI errors now carry the CLI output.

Milestone check, automated: call-test.ts registers two baresip phones and
holds a 30 s call with RTP both ways (pnpm test:asterisk); the recorded
session drives the live-state tests. scripts/e2e/m2-live.mjs runs api +
Asterisk + phones + browser on a private Docker network: a new extension
is live in Asterisk in ~1.3 s, the dashboard shows 2/2 online and red dots
during the call.

Task: M2-T6

docs/spec/04-backend-api.md

@@ -10,8 +10,9 @@
 5. Build Fastify: plugins (cookie, rate-limit, multipart, websocket, static for
    `./public` with SPA fallback to `index.html` for non-`/api`, non-`/prov`, non-`/hooks` paths), then routes.
 6. Listen on `127.0.0.1:${API_PORT}`.
-7. Start the AMI client (§4). On every successful login: sync AstDB (§5.5), load
-   live state (§5.1), `generator.apply({ trigger: 'startup', force: true })`.
+7. Start the AMI client (§4). On every successful login: sync AstDB (§5.5),
+   `generator.apply({ trigger: 'startup', force: true })`, then load live state (§5.1). The apply comes
+   first so hints for extensions created while Asterisk was away exist before their states are read.
 8. Start the voicemail watcher (§5.6) and the jobs (§8).
 9. On SIGTERM: stop jobs, close WS clients, close AMI, close DB, exit 0.