calls: limit outside calls at once, per extension and in total

Owner's decision after the M11-T8 review: nothing capped how many calls a stolen password could
run at once. Settings → Security: calls.maxPerExtension (3) and calls.maxTotal (10), 0 = no
limit. Each sp-route-* counts the caller's extension (or whose forward it is: SP_LIMITEXT from
sp-sub-forward) with GROUP(spext) and every outside call with GROUP(spout); over a limit the
caller hears "all circuits are busy". 911 is never limited.

trunk-test.ts on a real Asterisk, limits 1 and 2: a 2nd call from 101's phone and a 3rd in total
are refused (with both 0 the same check fails). call-limits.test.ts covers the 0 combinations.
Also fixes the Security tab's hint: browser phones still work from anywhere.

Task: M11-T8

apps/api/src/generator/dialplan/static.ts

@@ -57,6 +57,7 @@ exten => s,1,Set(__SP_FWDHOPS=$[\${IF($["\${SP_FWDHOPS}" = ""]?0:\${SP_FWDHOPS})
  same => n,GotoIf($[\${SP_FWDHOPS} > 3]?stop)
  same => n,GotoIf($[\${DIALPLAN_EXISTS(sp-local-numbers,\${ARG1},1)}]?internal)
  same => n,Set(SP_CLASS=\${GLOBAL(SP_CLASS_\${ARG2})})
+ same => n,Set(SP_LIMITEXT=\${ARG2})                    ; counts toward that extension's call limit
  same => n,Set(__SP_FORWARDED=1)
  same => n,Goto(sp-outbound-routes,\${ARG1},1)
  same => n(internal),Goto(sp-local-numbers,\${ARG1},1)