feat: add Event Socket integration (b2bcall-fs-events)

- packages/telephony: TelephonyProvider interface (agente.md secao 25) and
  FreeSwitchTelephonyProvider implementation over the 'esl' library
  (actively maintained, TypeScript-native, built-in reconnect-with-backoff
  satisfying secao 195); normalizeEslEvent() translates raw ESL events into
  the internal vocabulary (secao 24)
- apps/freeswitch-events (b2bcall-fs-events): permanent ESL connection,
  resubscribes on every reconnect, publishes normalized events to the
  'b2bcall:events' Redis pub/sub channel; containerized (Dockerfile +
  docker-compose service) since its whole job is reaching the freeswitch
  container by internal hostname
- packages/shared: reusable createLogger() (structured JSON per secao 189),
  fixed a BigInt serialization crash surfaced by the esl library's error
  stats
- found and fixed a real FreeSWITCH 1.11 default: without an explicit
  apply-inbound-acl, mod_event_socket silently rejects any non-loopback
  connection ('Access Denied, go away.') even with the correct password —
  added a dedicated ACL (loopback + the Docker Compose network range, never
  0.0.0.0/0) in infrastructure/freeswitch/overrides/autoload_configs/
- verified end-to-end with a local loopback test call: CALL_CREATED ->
  CALL_ANSWERED -> CALL_ENDED observed on the Redis channel with the
  correct callUuid and hangup cause
- docs/EVENT_SOCKET.md

infrastructure/freeswitch/Dockerfile

@@ -43,6 +43,8 @@ RUN --mount=type=secret,id=freeswitch_pat,required=true \
 # vanilla padrão por enquanto — serão substituídos por mod_xml_curl na fase
 # "Extensions/Trunks/Dialplan" (ver docs/FREESWITCH.md).
 COPY overrides/autoload_configs/modules.conf.xml /etc/freeswitch/autoload_configs/modules.conf.xml
+COPY overrides/autoload_configs/event_socket.conf.xml /etc/freeswitch/autoload_configs/event_socket.conf.xml
+COPY overrides/autoload_configs/acl.conf.xml /etc/freeswitch/autoload_configs/acl.conf.xml
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
 

infrastructure/freeswitch/entrypoint.sh

@@ -7,7 +7,7 @@ set -eu
 
 : "${ESL_PASSWORD:?ESL_PASSWORD precisa estar definido no ambiente do container}"
 
-sed -i "s/<param name=\"password\" value=\"ClueCon\"\/>/<param name=\"password\" value=\"${ESL_PASSWORD}\"\/>/" \
+sed -i "s/__ESL_PASSWORD__/${ESL_PASSWORD}/" \
   /etc/freeswitch/autoload_configs/event_socket.conf.xml
 
 exec "$@"

infrastructure/freeswitch/overrides/autoload_configs/acl.conf.xml

@@ -0,0 +1,14 @@
+<configuration name="acl.conf" description="Network Lists">
+  <network-lists>
+    <!-- ACL propria pro Event Socket: loopback (fs_cli local) + rede interna
+         do Docker Compose (outros containers, ex.: b2bcall-fs-events).
+         172.16.0.0/12 cobre o range padrao que o Docker aloca pras redes
+         bridge de projeto (confirmado: b2bcall_default = 172.18.0.0/16).
+         Nunca 0.0.0.0/0 — nao e' pra ser alcancavel de fora do host. -->
+    <list name="b2bcall_internal" default="deny">
+      <node type="allow" cidr="127.0.0.0/8"/>
+      <node type="allow" cidr="::1/128"/>
+      <node type="allow" cidr="172.16.0.0/12"/>
+    </list>
+  </network-lists>
+</configuration>

infrastructure/freeswitch/overrides/autoload_configs/event_socket.conf.xml

@@ -0,0 +1,16 @@
+<configuration name="event_socket.conf" description="Socket Client">
+  <settings>
+    <param name="nat-map" value="false"/>
+    <param name="listen-ip" value="::"/>
+    <param name="listen-port" value="8021"/>
+    <!-- Substituido em runtime pelo entrypoint.sh (nunca fica secret real na
+         imagem) -->
+    <param name="password" value="__ESL_PASSWORD__"/>
+    <!-- Sem isto, o FreeSWITCH 1.11 aplica um default implicito de
+         loopback-only e rejeita ("Access Denied, go away.") qualquer
+         conexao vinda de outro container Docker, mesmo com senha correta.
+         localnet.auto e' construida automaticamente no boot a partir da
+         subnet local detectada (cobre a rede do docker-compose). -->
+    <param name="apply-inbound-acl" value="b2bcall_internal"/>
+  </settings>
+</configuration>