softphone: dock panel, incoming dialog, hold/mute/DTMF, transfers, one tab

The dock opens a panel with a 12-key dialpad (typing, paste normalization,
Enter) and microphone/speaker selection. Call cards have mute, hold,
keypad (DTMF) and transfer: "Transfer now" (blind) or "Talk first"
(attended, with Complete/Cancel). An incoming call opens a dialog when
idle, or a card during a call (call waiting holds the first call). A
synthesized WebAudio ringtone and desktop notifications, auto-answer for
Call-Info answer-after=0, and a poor-connection warning from getStats.
One tab registers: a Web Lock plus a BroadcastChannel "Use here".

Found by e2e: Chrome can report canInsertDTMF=false, so DTMF falls back to
SIP INFO; after a REFER's 2xx NOTIFY the browser sends BYE itself (RFC
5589), otherwise SIP.js keeps the call up. apps/web/TESTING.md is the
12-step manual run for Chrome and Firefox (still open, roadmap note);
e2e m5-t2 automates most of it in headless Edge.

Task: M5-T2

docs/spec/09-roadmap.md

@@ -166,6 +166,10 @@ Legend: 📖 read · 🔨 build · ✅ done when
 **M5-T2** Dock UI, incoming dialog, hold/mute/DTMF, blind + attended transfer, one-tab leader election, audio device selection, notifications.
 ✅ A manual test script in `apps/web/TESTING.md` (12 steps) passes in Chrome and Firefox.
 
+> **⚠ Open manual check (M5-T2).** `scripts/e2e/m5-t2.mjs` passes in headless Edge in Docker
+> (incoming dialog, call waiting, hold, DTMF, blind + attended transfer, "Use here"). The owner
+> still has to run `apps/web/TESTING.md` in Chrome and Firefox on the real server.
+
 **M5-T3** Presence panel + click-to-call (`/api/me/click-to-call`).
 ✅ Presence dots change in < 1 s. Click-to-call rings the user's desk phone first.