feat: add FreeSWITCH service (SignalWire packages, not compiled from source)

- infrastructure/freeswitch/Dockerfile: debian:trixie-slim + SignalWire
  packaged freeswitch-meta-vanilla, avoiding a C/C++ build on a 1.9GB RAM VM
- FREESWITCH_PAT used only via Docker BuildKit secret, apt credentials file
  created and deleted within the same RUN — verified absent from the final
  image with docker history
- minimal module set (agente.md secao 15): sofia, event_socket, commands,
  dptools, callcenter, avmd, curl, local_stream, etc. mod_xml_curl installed
  but disabled — it refuses to load without a configured gateway-url, which
  will exist once b2bcall-fs-config is built
- entrypoint.sh rotates the Event Socket password away from the 'ClueCon'
  default at container runtime (never baked into the image); fails loudly if
  ESL_PASSWORD is unset
- port 8021 not published to the host; only reachable from other containers
  on the compose network
- found and fixed: freeswitch-conf-vanilla is a Recommends (not a Depends)
  of freeswitch-meta-vanilla, so --no-install-recommends silently produced
  an empty /etc/freeswitch and a crash loop
- verified end-to-end: fs_cli status via ESL with the custom password,
  default password rejected, expected modules loaded, healthcheck green,
  ~44MB RAM usage
- docs/FREESWITCH.md, docs/NETWORK_ARCHITECTURE.md (network_mode decision
  deferred until a real SIP trunk exists)

infrastructure/freeswitch/Dockerfile

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1.7
+#
+# Imagem própria/controlada do FreeSWITCH (agente.md secao 19), usando os
+# pacotes pré-compilados do SignalWire em vez de compilar da fonte — build
+# de C/C++ e´ pesado demais pra VM de laboratorio (1.9GB RAM).
+FROM debian:trixie-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates gnupg curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# FREESWITCH_PAT só existe durante este RUN (BuildKit secret, nunca vira
+# camada da imagem) e o arquivo de credenciais do apt é apagado antes do fim
+# do MESMO RUN — agente.md secao 11: "a credencial nao devera permanecer na
+# imagem runtime".
+RUN --mount=type=secret,id=freeswitch_pat,required=true \
+    set -eu; \
+    FS_PAT="$(cat /run/secrets/freeswitch_pat)"; \
+    curl -fsSL -u "signalwire:${FS_PAT}" \
+      https://freeswitch.signalwire.com/repo/deb/debian-release/signalwire-freeswitch-repo.gpg \
+      -o /usr/share/keyrings/signalwire-freeswitch-repo.gpg; \
+    install -d -m 700 /etc/apt/auth.conf.d; \
+    printf 'machine freeswitch.signalwire.com\nlogin signalwire\npassword %s\n' "${FS_PAT}" \
+      > /etc/apt/auth.conf.d/freeswitch.conf; \
+    chmod 600 /etc/apt/auth.conf.d/freeswitch.conf; \
+    echo "deb [signed-by=/usr/share/keyrings/signalwire-freeswitch-repo.gpg] https://freeswitch.signalwire.com/repo/deb/debian-release/ trixie main" \
+      > /etc/apt/sources.list.d/freeswitch.list; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+      freeswitch-meta-vanilla \
+      freeswitch-conf-vanilla \
+      freeswitch-mod-xml-curl \
+      freeswitch-mod-callcenter \
+      freeswitch-mod-avmd \
+      freeswitch-mod-curl; \
+    rm -f /etc/apt/auth.conf.d/freeswitch.conf /etc/apt/sources.list.d/freeswitch.list; \
+    rm -rf /var/lib/apt/lists/*
+
+# Overrides mínimos por cima da config vanilla (agente.md secao 15: "carregar
+# somente o necessário"). Directory/dialplan/sip_profiles ficam na config
+# vanilla padrão por enquanto — serão substituídos por mod_xml_curl na fase
+# "Extensions/Trunks/Dialplan" (ver docs/FREESWITCH.md).
+COPY overrides/autoload_configs/modules.conf.xml /etc/freeswitch/autoload_configs/modules.conf.xml
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+EXPOSE 8021
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["/usr/bin/freeswitch", "-nonat"]

infrastructure/freeswitch/entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# Aplica secrets de RUNTIME (nunca de build — a imagem nao carrega nenhum
+# valor real) antes de subir o FreeSWITCH. Falha alto se ESL_PASSWORD nao
+# estiver definido: nunca cair silenciosamente na senha padrao "ClueCon"
+# (agente.md secao 22).
+set -eu
+
+: "${ESL_PASSWORD:?ESL_PASSWORD precisa estar definido no ambiente do container}"
+
+sed -i "s/<param name=\"password\" value=\"ClueCon\"\/>/<param name=\"password\" value=\"${ESL_PASSWORD}\"\/>/" \
+  /etc/freeswitch/autoload_configs/event_socket.conf.xml
+
+exec "$@"

infrastructure/freeswitch/overrides/autoload_configs/modules.conf.xml

@@ -0,0 +1,75 @@
+<configuration name="modules.conf" description="Modules">
+  <modules>
+    <!-- Loggers (I'd load these first) -->
+    <load module="mod_console"/>
+    <load module="mod_logfile"/>
+
+    <!-- Multi-Faceted -->
+    <load module="mod_enum"/>
+
+    <!-- XML Interfaces (agente.md secao 26: mod_xml_curl para Directory/Dialplan) -->
+    <!-- Desativado por enquanto: mod_xml_curl recusa carregar sem pelo menos
+         um binding com gateway-url configurada (falha "Binding has no url!"
+         com o xml_curl.conf.xml default, que vem com tudo comentado). Ativar
+         junto com o b2bcall-fs-config na fase "XML Curl" do agente.md. -->
+    <!-- <load module="mod_xml_curl"/> -->
+
+    <!-- Event Handlers -->
+    <load module="mod_cdr_csv"/>
+    <load module="mod_event_socket"/>
+
+    <!-- Endpoints -->
+    <load module="mod_sofia"/>
+    <load module="mod_loopback"/>
+    <load module="mod_rtc"/>
+    <load module="mod_verto"/>
+
+    <!-- Applications -->
+    <!-- mod_signalwire removido: nao usamos o SignalWire Cloud, so o repo de pacotes -->
+    <load module="mod_commands"/>
+    <load module="mod_conference"/>
+    <load module="mod_curl"/>
+    <load module="mod_db"/>
+    <load module="mod_dptools"/>
+    <load module="mod_expr"/>
+    <load module="mod_fifo"/>
+    <load module="mod_hash"/>
+    <load module="mod_voicemail"/>
+    <load module="mod_esf"/>
+    <load module="mod_fsv"/>
+    <load module="mod_valet_parking"/>
+    <load module="mod_httapi"/>
+
+    <!-- Call Center / ACD (agente.md secao 37) -->
+    <load module="mod_callcenter"/>
+
+    <!-- Answering Machine / Beep detection (agente.md secao 87) -->
+    <load module="mod_avmd"/>
+
+    <!-- Dialplan Interfaces -->
+    <load module="mod_dialplan_xml"/>
+    <load module="mod_dialplan_asterisk"/>
+
+    <!-- Codec Interfaces -->
+    <load module="mod_spandsp"/>
+    <load module="mod_g723_1"/>
+    <load module="mod_g729"/>
+    <load module="mod_amr"/>
+    <load module="mod_b64"/>
+    <load module="mod_opus"/>
+
+    <!-- File Format Interfaces -->
+    <load module="mod_av"/>
+    <load module="mod_sndfile"/>
+    <load module="mod_native_file"/>
+    <load module="mod_png"/>
+    <load module="mod_local_stream"/>
+    <load module="mod_tone_stream"/>
+
+    <!-- Languages -->
+    <load module="mod_lua"/>
+
+    <!-- Say -->
+    <load module="mod_say_en"/>
+  </modules>
+</configuration>