feat: add FreeSWITCH service (SignalWire packages, not compiled from source)

- infrastructure/freeswitch/Dockerfile: debian:trixie-slim + SignalWire
  packaged freeswitch-meta-vanilla, avoiding a C/C++ build on a 1.9GB RAM VM
- FREESWITCH_PAT used only via Docker BuildKit secret, apt credentials file
  created and deleted within the same RUN — verified absent from the final
  image with docker history
- minimal module set (agente.md secao 15): sofia, event_socket, commands,
  dptools, callcenter, avmd, curl, local_stream, etc. mod_xml_curl installed
  but disabled — it refuses to load without a configured gateway-url, which
  will exist once b2bcall-fs-config is built
- entrypoint.sh rotates the Event Socket password away from the 'ClueCon'
  default at container runtime (never baked into the image); fails loudly if
  ESL_PASSWORD is unset
- port 8021 not published to the host; only reachable from other containers
  on the compose network
- found and fixed: freeswitch-conf-vanilla is a Recommends (not a Depends)
  of freeswitch-meta-vanilla, so --no-install-recommends silently produced
  an empty /etc/freeswitch and a crash loop
- verified end-to-end: fs_cli status via ESL with the custom password,
  default password rejected, expected modules loaded, healthcheck green,
  ~44MB RAM usage
- docs/FREESWITCH.md, docs/NETWORK_ARCHITECTURE.md (network_mode decision
  deferred until a real SIP trunk exists)

docker-compose.yml

@@ -32,6 +32,29 @@ services:
       timeout: 5s
       retries: 10
 
+  freeswitch:
+    build:
+      context: ./infrastructure/freeswitch
+      secrets:
+        - freeswitch_pat
+    container_name: b2bcall-freeswitch
+    restart: unless-stopped
+    environment:
+      ESL_PASSWORD: ${ESL_PASSWORD}
+    # Nenhuma porta publicada no host: SIP/RTP ainda não têm troncos reais
+    # configurados, e o Event Socket (8021) só deve ser alcançável por outros
+    # containers na rede interna do compose (agente.md secao 22).
+    healthcheck:
+      test: ["CMD-SHELL", "fs_cli -p \"$$ESL_PASSWORD\" -x status | grep -q 'is ready'"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+
+secrets:
+  freeswitch_pat:
+    environment: FREESWITCH_PAT
+
 volumes:
   postgres_data:
   redis_data: