feat: implement Extensions with real FreeSWITCH directory integration

- extensions table (tenant-scoped, RLS): number, sip_password_enc
  (AES-256-GCM via packages/shared/src/crypto.ts), caller_id, context,
  sofia_profile, codecs, max_registrations
- apps/api/src/extensions: CRUD (POST/GET/GET:id/DELETE), protected by a
  new generic PermissionGuard (@RequirePermission decorator), tenant
  resolved only from the JWT (never trusted from the client)
- SIP password is returned in plaintext only once, in the create response;
  toPublicExtension() explicitly destructures the encrypted field out
  (not a spread) so it can't leak by accident
- b2bcall-fs-config now resolves real directory data: Tenant.telephonyDomain
  -> Extension.number, decrypts the password, builds proper directory XML
  including a dial-string param (missing it caused originate to fail with
  MANDATORY_IE_MISSING instead of the expected USER_NOT_REGISTERED)
- pinned FreeSWITCH's 357737{domain} to a stable value (b2bcall.local) via a
  vars.xml patch in the Dockerfile -- it previously used the container's
  dynamic IP, which could never match a stored telephony_domain
- added HTTP Basic auth between FreeSWITCH and fs-config
  (gateway-credentials, timingSafeEqual comparison) now that the service
  returns real secret data, closing the gap flagged as pending in the XML
  Curl phase instead of leaving it open
- found and fixed: PermissionGuard's constructor-injected Reflector came
  back undefined at runtime under tsx/esbuild (unreliable cross-file
  decorator metadata emission) -- fixed with an explicit @Inject(Reflector);
  worth watching for in future guards/services run via tsx
- verified end-to-end: create extension -> originate user/<ext> reports
  USER_NOT_REGISTERED (found, not registered) -> delete -> back to
  SUBSCRIBER_ABSENT (not found); password never reappears in any GET;
  unauthenticated fs-config requests get 401
- docs/EXTENSIONS.md

packages/database/prisma/schema.prisma

@@ -34,6 +34,7 @@ model Tenant {
 
   memberships      TenantMembership[]
   userRoles        UserRole[]
+  extensions       Extension[]
 
   @@map("tenants")
 }
@@ -181,3 +182,38 @@ model TenantMembership {
   @@index([tenantId])
   @@map("tenant_memberships")
 }
+
+// Tabela tenant-scoped protegida por Row Level Security. sipPasswordEnc
+// guarda a senha SIP cifrada (AES-256-GCM, ver packages/shared/src/crypto.ts)
+// — nunca texto puro (agente.md secao 178).
+model Extension {
+  id               String   @id @default(uuid()) @db.Uuid
+  tenantId         String   @map("tenant_id") @db.Uuid
+
+  number           String
+  name             String
+  domain           String
+
+  sipPasswordEnc   String   @map("sip_password_enc")
+
+  callerIdName     String?  @map("caller_id_name")
+  callerIdNumber   String?  @map("caller_id_number")
+
+  context          String   @default("default")
+  sofiaProfile     String   @default("internal") @map("sofia_profile")
+  codecs           String   @default("PCMU,PCMA,OPUS") @map("codecs")
+
+  maxRegistrations Int      @default(1) @map("max_registrations")
+
+  enabled          Boolean  @default(true)
+
+  createdAt        DateTime @default(now()) @map("created_at")
+  updatedAt        DateTime @updatedAt @map("updated_at")
+  deletedAt        DateTime? @map("deleted_at")
+
+  tenant           Tenant   @relation(fields: [tenantId], references: [id])
+
+  @@unique([tenantId, number])
+  @@index([tenantId])
+  @@map("extensions")
+}