calls: limit outside calls at once, per extension and in total

Owner's decision after the M11-T8 review: nothing capped how many calls a stolen password could
run at once. Settings → Security: calls.maxPerExtension (3) and calls.maxTotal (10), 0 = no
limit. Each sp-route-* counts the caller's extension (or whose forward it is: SP_LIMITEXT from
sp-sub-forward) with GROUP(spext) and every outside call with GROUP(spout); over a limit the
caller hears "all circuits are busy". 911 is never limited.

trunk-test.ts on a real Asterisk, limits 1 and 2: a 2nd call from 101's phone and a 3rd in total
are refused (with both 0 the same check fails). call-limits.test.ts covers the 0 combinations.
Also fixes the Security tab's hint: browser phones still work from anywhere.

Task: M11-T8

docs/admin-guide/network.md

@@ -158,7 +158,11 @@ real money. Keep:
 
 - international calling **off** at voip.ms and in **Outbound rules** unless you need it;
 - the voip.ms **balance alerts and spending limits** on;
-- the **desk phone network limit** above on if your phones are all in the office.
+- the **desk phone network limit** above on if your phones are all in the office;
+- the **outside calls at once** limits (Settings → Security) as low as your office needs: per
+  extension (3 by default) and for the whole system (10). A stolen password then runs up at most
+  that many calls at a time. Forwarded calls count for the person who set the forward; 911 is
+  never limited. Callers over a limit hear "all circuits are busy".
 
 Never reuse a SIP password. SelfPhoneNG generates long random ones; phones get them from the
 setup files.