provisioning: Linphone setup QR, "Set up a phone app"

GET /api/extensions/:id/softphone-qr (admin) and /api/me/softphone-qr
return {url, qr, expiresAt}: the link Linphone fetches and its QR as a
PNG data URL (qrcode), valid 24 h. Both are audited like revealing the
SIP password. JSON rather than a bare PNG, so the page can show the
link for desktop Linphone too.

The token is stateless per 07 §5: base64url(extensionId.expiry.hmac),
HMAC-SHA256 with APP_SECRET, checked timing-safe. /prov/linphone/
<token>.xml matches it before the other file names are lower-cased
(the token is case-sensitive); a bad or expired token is a 404 and a
counted failure. auth_info keys checked against liblinphone's config
reader; proxy keys stay (verify).

Web: a "Set up a phone app" section on My settings and in the admin
Credentials tab: Linphone with the QR, MicroSIP/Baresip by hand, and
the plain warning about mobile apps without push. e2e m10-t3: as a
user, the QR's link gives the XML and a baresip phone registers with
only what it holds.

Task: M10-T3

apps/api/test/devices.test.ts

@@ -4,7 +4,7 @@
 import type { LightMyRequestResponse } from 'fastify';
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
 import { eq } from 'drizzle-orm';
-import { contacts, devices } from '../src/db/schema.ts';
+import { auditLog, contacts, devices } from '../src/db/schema.ts';
 import { resetProvLimiter } from '../src/provisioning/limiter.ts';
 import { setSetting } from '../src/services/settings.ts';
 import { hasTestDb } from './db.ts';
@@ -230,6 +230,28 @@ describe.skipIf(!hasTestDb)('/api/devices and /prov', () => {
     await setSetting(t.db, 'general.timezone', 'America/Chicago');
   });
 
+  it('M10-T3: Linphone QR (admin and me), the token is the credential, audited', async () => {
+    const r = await req('GET', `/api/extensions/${extId}/softphone-qr`);
+    expect(r.statusCode, r.body).toBe(200);
+    const { url, qr } = r.json();
+    expect(qr).toMatch(/^data:image\/png;base64,/);
+    expect(url).toMatch(/^https:\/\/pbx\.test\/prov\/linphone\/[A-Za-z0-9_-]+\.xml$/);
+    const path = new URL(url).pathname.slice('/prov/'.length);
+    const x = await prov(path, '203.0.113.20'); // a mobile phone, no Basic auth
+    expect(x.statusCode).toBe(200);
+    expect(x.body).toContain('<entry name="username">101</entry>');
+    expect(x.body).toContain(`<entry name="passwd">${sipPassword}</entry>`);
+    // the token is case-sensitive: a lower-cased one is just a bad token
+    expect((await prov(path.toLowerCase(), '203.0.113.21')).statusCode).toBe(404);
+    expect((await prov('linphone/AAAAAAAAAAAAAAAAAAAAAAAA.xml', '203.0.113.21')).statusCode).toBe(
+      404,
+    );
+    const logged = JSON.stringify(await t.db.select().from(auditLog));
+    expect(logged).toContain('Made a phone app setup QR for extension 101');
+    // a user with no extension gets a 404 from /api/me
+    expect((await req('GET', '/api/me/softphone-qr')).statusCode).toBe(404);
+  });
+
   it('delete: the phone gets nothing any more', async () => {
     expect((await req('DELETE', `/api/devices/${device.id}`)).statusCode).toBe(200);
     expect(