feat: implement Trunks with real FreeSWITCH gateway sync

- trunks table (tenant-scoped, RLS): host/proxy/realm, register,
  username/password_enc (AES-256-GCM), dtmf_mode, ping, transport, and a
  status/status_updated_at pair meant to be driven by FreeSWITCH events
- apps/api/src/trunks: CRUD (POST/GET/GET:id/DELETE), same RBAC/tenant
  pattern as Extensions, password never exposed in any GET
- packages/telephony: buildGatewayXml() generates a Sofia gateway XML file
- b2bcall-fs-config now writes sip_profiles/external/<trunk_id>.xml (shared
  Docker volume with FreeSWITCH -- the vanilla external profile already
  includes external/*.xml) and runs 'sofia profile external rescan' over
  ESL; syncs on boot and on demand via Redis pub/sub
  (b2bcall:trunks:sync), since apps/api runs on the host and fs-config has
  no port published to reach directly
- added FreeSwitchTelephonyProvider.waitUntilConnected() to fix a startup
  race: the first sync ran before the ESL connection had settled, logging
  a harmless but noisy error
- verified end-to-end with a fake host: create trunk -> gateway file
  written -> FreeSWITCH shows the real gateway (FAIL_WAIT, expected) ->
  delete -> file removed (cleanup also correctly swept the stale
  'example.com' gateway that had been copied into the volume from the
  vanilla image)
- apps/freeswitch-events/src/trunk-status.ts: written to update Trunk.status
  from sofia::gateway_state events, using the same normalizeEslEvent path
  already proven for CHANNEL_* events

- KNOWN GAP, documented rather than glossed over: monitored fs-events for
  ~90s while the gateway visibly transitioned states in FreeSWITCH
  (FAIL_WAIT/DOWN) and no sofia::gateway_state event was observed arriving.
  CUSTOM/sofia::* events have not actually been proven working end-to-end
  in this session -- only CHANNEL_* events have been. Needs verification
  against a real SIP target before the status auto-update can be trusted
  in production. See docs/TRUNKS.md and TODO.md.

- docs/TRUNKS.md

packages/telephony/src/freeswitch-provider.ts

@@ -54,6 +54,22 @@ export class FreeSwitchTelephonyProvider implements TelephonyProvider {
     await this.client.end();
   }
 
+  /**
+   * Espera a primeira conexão ficar pronta (ou já estar pronta), com
+   * timeout. Útil pra evitar corrida entre "acabei de chamar connect()" e
+   * "já quero mandar um comando" logo no boot do serviço.
+   */
+  async waitUntilConnected(timeoutMs = 5000): Promise<boolean> {
+    if (this.current) return true;
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => resolve(false), timeoutMs);
+      this.client.once("connect", () => {
+        clearTimeout(timer);
+        resolve(true);
+      });
+    });
+  }
+
   private call(): FreeSwitchResponse {
     if (!this.current) {
       throw new Error("FreeSWITCH ESL nao conectado");
@@ -144,4 +160,15 @@ export class FreeSwitchTelephonyProvider implements TelephonyProvider {
   async reloadXml(): Promise<void> {
     await this.call().api("reloadxml");
   }
+
+  /**
+   * Escape hatch pra comandos `api` que não têm método dedicado na
+   * interface TelephonyProvider (ex.: `sofia profile external rescan`).
+   * Não faz parte da interface abstrata de proposito — usar com moderação,
+   * preferir os métodos tipados quando existirem.
+   */
+  async runApi(command: string): Promise<string> {
+    const res = await this.call().api(command);
+    return res.body;
+  }
 }