feat: implement Trunks with real FreeSWITCH gateway sync

- trunks table (tenant-scoped, RLS): host/proxy/realm, register,
  username/password_enc (AES-256-GCM), dtmf_mode, ping, transport, and a
  status/status_updated_at pair meant to be driven by FreeSWITCH events
- apps/api/src/trunks: CRUD (POST/GET/GET:id/DELETE), same RBAC/tenant
  pattern as Extensions, password never exposed in any GET
- packages/telephony: buildGatewayXml() generates a Sofia gateway XML file
- b2bcall-fs-config now writes sip_profiles/external/<trunk_id>.xml (shared
  Docker volume with FreeSWITCH -- the vanilla external profile already
  includes external/*.xml) and runs 'sofia profile external rescan' over
  ESL; syncs on boot and on demand via Redis pub/sub
  (b2bcall:trunks:sync), since apps/api runs on the host and fs-config has
  no port published to reach directly
- added FreeSwitchTelephonyProvider.waitUntilConnected() to fix a startup
  race: the first sync ran before the ESL connection had settled, logging
  a harmless but noisy error
- verified end-to-end with a fake host: create trunk -> gateway file
  written -> FreeSWITCH shows the real gateway (FAIL_WAIT, expected) ->
  delete -> file removed (cleanup also correctly swept the stale
  'example.com' gateway that had been copied into the volume from the
  vanilla image)
- apps/freeswitch-events/src/trunk-status.ts: written to update Trunk.status
  from sofia::gateway_state events, using the same normalizeEslEvent path
  already proven for CHANNEL_* events

- KNOWN GAP, documented rather than glossed over: monitored fs-events for
  ~90s while the gateway visibly transitioned states in FreeSWITCH
  (FAIL_WAIT/DOWN) and no sofia::gateway_state event was observed arriving.
  CUSTOM/sofia::* events have not actually been proven working end-to-end
  in this session -- only CHANNEL_* events have been. Needs verification
  against a real SIP target before the status auto-update can be trusted
  in production. See docs/TRUNKS.md and TODO.md.

- docs/TRUNKS.md

apps/freeswitch-config/src/main.ts

@@ -1,13 +1,17 @@
 import { timingSafeEqual } from "node:crypto";
 import Fastify from "fastify";
 import formbody from "@fastify/formbody";
+import Redis from "ioredis";
 import { getPrismaClient, withTenantContext } from "@b2bcall/database";
 import { decryptSecret } from "@b2bcall/shared";
 import { buildDirectoryUserXml, NOT_FOUND_XML } from "@b2bcall/telephony";
 import { createLogger } from "@b2bcall/shared";
+import { syncTrunks } from "./trunk-sync";
 
 const logger = createLogger("b2bcall-fs-config");
 
+const TRUNKS_SYNC_CHANNEL = "b2bcall:trunks:sync";
+
 function requireEnv(name: string): string {
   const value = process.env[name];
   if (!value) {
@@ -120,6 +124,18 @@ async function main() {
   const port = Number(process.env.PORT ?? 8080);
   await app.listen({ port, host: "0.0.0.0" });
   logger.info(`b2bcall-fs-config ouvindo na porta ${port}`);
+
+  // apps/api publica no canal apos criar/editar/apagar um trunk (agente.md
+  // secao 41-42). Roda uma sincronizacao inicial tambem, pra cobrir trunks
+  // criados enquanto este servico estava fora do ar.
+  const subscriber = new Redis(process.env.REDIS_URL!);
+  subscriber.on("error", (err) => logger.error("erro na conexao Redis (subscriber)", { error: String(err) }));
+  await subscriber.subscribe(TRUNKS_SYNC_CHANNEL);
+  subscriber.on("message", (_channel, _msg) => {
+    syncTrunks().catch((err) => logger.error("falha ao sincronizar trunks", { error: String(err) }));
+  });
+
+  syncTrunks().catch((err) => logger.error("falha na sincronizacao inicial de trunks", { error: String(err) }));
 }
 
 main().catch((err) => {