feat: add FreeSWITCH service (SignalWire packages, not compiled from source)

- infrastructure/freeswitch/Dockerfile: debian:trixie-slim + SignalWire
  packaged freeswitch-meta-vanilla, avoiding a C/C++ build on a 1.9GB RAM VM
- FREESWITCH_PAT used only via Docker BuildKit secret, apt credentials file
  created and deleted within the same RUN — verified absent from the final
  image with docker history
- minimal module set (agente.md secao 15): sofia, event_socket, commands,
  dptools, callcenter, avmd, curl, local_stream, etc. mod_xml_curl installed
  but disabled — it refuses to load without a configured gateway-url, which
  will exist once b2bcall-fs-config is built
- entrypoint.sh rotates the Event Socket password away from the 'ClueCon'
  default at container runtime (never baked into the image); fails loudly if
  ESL_PASSWORD is unset
- port 8021 not published to the host; only reachable from other containers
  on the compose network
- found and fixed: freeswitch-conf-vanilla is a Recommends (not a Depends)
  of freeswitch-meta-vanilla, so --no-install-recommends silently produced
  an empty /etc/freeswitch and a crash loop
- verified end-to-end: fs_cli status via ESL with the custom password,
  default password rejected, expected modules loaded, healthcheck green,
  ~44MB RAM usage
- docs/FREESWITCH.md, docs/NETWORK_ARCHITECTURE.md (network_mode decision
  deferred until a real SIP trunk exists)

infrastructure/freeswitch/Dockerfile

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1.7
+#
+# Imagem própria/controlada do FreeSWITCH (agente.md secao 19), usando os
+# pacotes pré-compilados do SignalWire em vez de compilar da fonte — build
+# de C/C++ e´ pesado demais pra VM de laboratorio (1.9GB RAM).
+FROM debian:trixie-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates gnupg curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# FREESWITCH_PAT só existe durante este RUN (BuildKit secret, nunca vira
+# camada da imagem) e o arquivo de credenciais do apt é apagado antes do fim
+# do MESMO RUN — agente.md secao 11: "a credencial nao devera permanecer na
+# imagem runtime".
+RUN --mount=type=secret,id=freeswitch_pat,required=true \
+    set -eu; \
+    FS_PAT="$(cat /run/secrets/freeswitch_pat)"; \
+    curl -fsSL -u "signalwire:${FS_PAT}" \
+      https://freeswitch.signalwire.com/repo/deb/debian-release/signalwire-freeswitch-repo.gpg \
+      -o /usr/share/keyrings/signalwire-freeswitch-repo.gpg; \
+    install -d -m 700 /etc/apt/auth.conf.d; \
+    printf 'machine freeswitch.signalwire.com\nlogin signalwire\npassword %s\n' "${FS_PAT}" \
+      > /etc/apt/auth.conf.d/freeswitch.conf; \
+    chmod 600 /etc/apt/auth.conf.d/freeswitch.conf; \
+    echo "deb [signed-by=/usr/share/keyrings/signalwire-freeswitch-repo.gpg] https://freeswitch.signalwire.com/repo/deb/debian-release/ trixie main" \
+      > /etc/apt/sources.list.d/freeswitch.list; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+      freeswitch-meta-vanilla \
+      freeswitch-conf-vanilla \
+      freeswitch-mod-xml-curl \
+      freeswitch-mod-callcenter \
+      freeswitch-mod-avmd \
+      freeswitch-mod-curl; \
+    rm -f /etc/apt/auth.conf.d/freeswitch.conf /etc/apt/sources.list.d/freeswitch.list; \
+    rm -rf /var/lib/apt/lists/*
+
+# Overrides mínimos por cima da config vanilla (agente.md secao 15: "carregar
+# somente o necessário"). Directory/dialplan/sip_profiles ficam na config
+# vanilla padrão por enquanto — serão substituídos por mod_xml_curl na fase
+# "Extensions/Trunks/Dialplan" (ver docs/FREESWITCH.md).
+COPY overrides/autoload_configs/modules.conf.xml /etc/freeswitch/autoload_configs/modules.conf.xml
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+EXPOSE 8021
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["/usr/bin/freeswitch", "-nonat"]