feat: add Event Socket integration (b2bcall-fs-events)

- packages/telephony: TelephonyProvider interface (agente.md secao 25) and
  FreeSwitchTelephonyProvider implementation over the 'esl' library
  (actively maintained, TypeScript-native, built-in reconnect-with-backoff
  satisfying secao 195); normalizeEslEvent() translates raw ESL events into
  the internal vocabulary (secao 24)
- apps/freeswitch-events (b2bcall-fs-events): permanent ESL connection,
  resubscribes on every reconnect, publishes normalized events to the
  'b2bcall:events' Redis pub/sub channel; containerized (Dockerfile +
  docker-compose service) since its whole job is reaching the freeswitch
  container by internal hostname
- packages/shared: reusable createLogger() (structured JSON per secao 189),
  fixed a BigInt serialization crash surfaced by the esl library's error
  stats
- found and fixed a real FreeSWITCH 1.11 default: without an explicit
  apply-inbound-acl, mod_event_socket silently rejects any non-loopback
  connection ('Access Denied, go away.') even with the correct password —
  added a dedicated ACL (loopback + the Docker Compose network range, never
  0.0.0.0/0) in infrastructure/freeswitch/overrides/autoload_configs/
- verified end-to-end with a local loopback test call: CALL_CREATED ->
  CALL_ANSWERED -> CALL_ENDED observed on the Redis channel with the
  correct callUuid and hangup cause
- docs/EVENT_SOCKET.md

TODO.md

@@ -27,6 +27,21 @@
       teste 1000-1019, senhas fracas) — substituir por mod_xml_curl na fase
       Extensions/Trunks/Dialplan
 
+## PHASE 06 — Event Socket (agente.md secao 21-25, 195)
+- [x] `packages/telephony`: interface `TelephonyProvider` + `FreeSwitchTelephonyProvider`
+      (sobre a lib `esl`, reconexão com backoff já embutida na lib)
+- [x] `normalizeEslEvent()`: eventos ESL crus → vocabulário interno (secao 24)
+- [x] `apps/freeswitch-events` (b2bcall-fs-events): conexão ESL permanente,
+      resubscreve a cada reconexão, publica eventos normalizados no canal Redis
+      `b2bcall:events`
+- [x] Achado: FreeSWITCH 1.11 aplica ACL implícita (só loopback) sem
+      `apply-inbound-acl` — bloqueava conexão de outro container mesmo com
+      senha certa. Corrigido com ACL própria cobrindo loopback + rede Docker.
+- [x] Testado ponta a ponta com chamada loopback local: CALL_CREATED →
+      CALL_ANSWERED → CALL_ENDED corretos no Redis
+- [ ] Reconciliação pós-reconexão (calls/agents/queues/registrations/gateways)
+      — não é possível ainda, sem essas tabelas persistidas
+
 ## PHASE 02 — SaaS Core
 - [x] Monorepo Node.js/TypeScript (pnpm workspaces, tsconfig base)
 - [x] Node 22 LTS + pnpm instalados no host
@@ -58,7 +73,7 @@
       — testado ponta a ponta com curl (login, refresh rotation, logout, RBAC, 401/403/429)
 - [ ] Password reset por e-mail — depende de SMTP configurado
 
-## PHASE 06+ — ver `agente.md` seções 21 em diante (Event Socket, XML Curl, Telefonia,
+## PHASE 07+ — ver `agente.md` seções 26 em diante (XML Curl, Extensions, Trunks, Dialplan,
 Call Center, Predictive Dialer, Recordings, AI, Billing, Frontend, Reports, Security, Tests)
 
 ---