feat(dialer): CPS Limiter + Predictive Dialer Engine

Fecha agente.md secao 72-86 (motor preditivo) e 77-79 (CPS distribuido,
reserva de leads, lock de campanha). Uma campanha RUNNING agora origina
chamadas sozinha, respeitando capacidade de agentes, CPS hierarquico e
taxa de abandono — sem intervencao manual.

Deliberadamente fora do escopo (agente.md secao 72: "nao e' so' `for lead
-> originate`"): mod_avmd (opcional), callbacks agendados, disposicoes de
agente — ficam pra fase CDR.

## Novo servico apps/predictive-dialer

Mesmo padrao arquitetural de fs-events/fs-config: Node standalone em
Docker, ESL propria, tick a cada 2s sobre tenants ativos x campanhas
RUNNING/WAITING_SCHEDULE.

- Lock de campanha (dialer:campaign:{id}, secao 79): TTL/ownership/
  renewal/safe-release via Lua compare-and-delete.
- CPS distribuido (secao 77, 62): token bucket janela 1s, hierarquia
  GLOBAL/TENANT/TRUNK/CAMPAIGN numa unica chamada Lua atomica — nivel
  esgotado bloqueia todos SEM incremento parcial dos que passariam.
- Reserva atomica de leads (secao 78): FOR UPDATE SKIP LOCKED dentro da
  mesma transacao withTenantContext.
- CallAttempt/CampaignStats (schema novo): state machine da chamada
  (secao 82) + EWMA (secao 75) de answer_probability/average_answer_delay/
  average_talk_time/abandon_rate por campanha.
- Capacidade em tempo real + pacing (secao 73-76, 84-85): conta agentes
  por estado via Tier->Agent.state, previsao de liberacao (horizonte
  unico de 15s, simplificacao documentada dos 4 buckets da especificacao),
  controle de abandono reduz pacing progressivamente, nunca origina sem
  capacidade prevista.

## Modo simulacao (secao 185-186)

DIALER_SIMULATION=true (default, ja estava no .env desde o inicio da
sessao) sorteia ANSWER/BUSY/NO_ANSWER/FAILED em software, sem PSTN real.
So' quando ANSWERED e' que uma chamada sintetica (null/dummy, sem PSTN)
entra na fila real via mod_callcenter de verdade — escolha deliberada pra
maximizar codigo real exercitado em vez de simular tudo em memoria. Os
identificadores da secao 81 (b2bcall_tenant_id/call_id/attempt_id/
campaign_id/lead_id) vao como channel variables nessa perna, entregando
tenantId real no WebSocket sem fan-out.

Real Outbound Safety (secao 186): as duas flags checadas no boot, nunca
ativadas automaticamente — caminho PSTN real implementado mas nunca
exercitado (sem trunk/operadora real neste laboratorio).

## Dois bugs reais achados e corrigidos testando esta fase

- Perna sintetica (null/dummy) nao tem midia do outro lado — nunca
  desligava sozinha depois de bridgear com um agente. Corrigido com
  hangup agendado via uuid_kill no talk_time simulado.
- Corrida entre queue:sync e tier:sync (dois canais Redis independentes,
  sem ordem garantida): atribuir tier logo depois de criar a fila podia
  rodar tier add antes do queue reload terminar ("-ERR Queue not found!",
  erro real, diferente do ja conhecido "already exist"). Corrigido com
  retry curto (ate 3 tentativas) em agent-sync.ts::addTierWithRetry.

## GET /campaigns/:id/stats

Secao 227.7 "visualizar pacing" — CampaignStats + agentes por estado +
calls em andamento, sem esperar a fase Frontend.

Verificado ponta a ponta: campanha RUNNING originando 3 tentativas por
tick, outcomes simulados corretos com retry agendado (BUSY 15min/
NO_ANSWER 60min/FAILED 30min), uma tentativa ANSWERED completando o ciclo
real inteiro (fila -> agente -> bridge -> hangup -> EWMA atualizada),
stop nao derruba chamada ativa (secao 66), calls_answered=3 confirmado no
`queue list` do FreeSWITCH. CPS limiter e lock de campanha testados
isoladamente (hierarquia sem incremento parcial, ownership nunca
roubado). typecheck do workspace inteiro limpo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X1HxY46WGU4G1zmVDNKcWw

packages/database/prisma/migrations/20260828155954_call_attempts_campaign_stats/migration.sql

@@ -0,0 +1,60 @@
+-- CreateEnum
+CREATE TYPE "call_attempt_status" AS ENUM ('CREATED', 'RESERVED', 'ORIGINATING', 'ORIGINATED', 'RINGING', 'ANSWERED', 'QUEUEING', 'AGENT_CONNECTED', 'COMPLETED', 'BUSY', 'NO_ANSWER', 'FAILED', 'ABANDONED');
+
+-- CreateTable
+CREATE TABLE "call_attempts" (
+    "id" UUID NOT NULL,
+    "tenant_id" UUID NOT NULL,
+    "campaign_id" UUID NOT NULL,
+    "lead_id" UUID NOT NULL,
+    "agent_id" UUID,
+    "origination_uuid" UUID,
+    "status" "call_attempt_status" NOT NULL DEFAULT 'CREATED',
+    "simulated" BOOLEAN NOT NULL DEFAULT false,
+    "hangup_cause" TEXT,
+    "talk_time_seconds" INTEGER,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "ringing_at" TIMESTAMP(3),
+    "answered_at" TIMESTAMP(3),
+    "bridged_at" TIMESTAMP(3),
+    "ended_at" TIMESTAMP(3),
+
+    CONSTRAINT "call_attempts_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "campaign_stats" (
+    "campaign_id" UUID NOT NULL,
+    "answer_probability" DOUBLE PRECISION NOT NULL DEFAULT 0.4,
+    "average_answer_delay" DOUBLE PRECISION NOT NULL DEFAULT 5,
+    "average_talk_time" DOUBLE PRECISION NOT NULL DEFAULT 180,
+    "abandon_rate" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "pacing_factor" DOUBLE PRECISION NOT NULL DEFAULT 1.0,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "campaign_stats_pkey" PRIMARY KEY ("campaign_id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "call_attempts_origination_uuid_key" ON "call_attempts"("origination_uuid");
+
+-- CreateIndex
+CREATE INDEX "call_attempts_tenant_id_idx" ON "call_attempts"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "call_attempts_campaign_id_status_idx" ON "call_attempts"("campaign_id", "status");
+
+-- AddForeignKey
+ALTER TABLE "call_attempts" ADD CONSTRAINT "call_attempts_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "call_attempts" ADD CONSTRAINT "call_attempts_campaign_id_fkey" FOREIGN KEY ("campaign_id") REFERENCES "campaigns"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "call_attempts" ADD CONSTRAINT "call_attempts_lead_id_fkey" FOREIGN KEY ("lead_id") REFERENCES "leads"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "call_attempts" ADD CONSTRAINT "call_attempts_agent_id_fkey" FOREIGN KEY ("agent_id") REFERENCES "agents"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "campaign_stats" ADD CONSTRAINT "campaign_stats_campaign_id_fkey" FOREIGN KEY ("campaign_id") REFERENCES "campaigns"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

packages/database/prisma/migrations/20260828160116_add_tenant_to_campaign_stats/migration.sql

@@ -0,0 +1,14 @@
+/*
+  Warnings:
+
+  - Added the required column `tenant_id` to the `campaign_stats` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- AlterTable
+ALTER TABLE "campaign_stats" ADD COLUMN     "tenant_id" UUID NOT NULL;
+
+-- CreateIndex
+CREATE INDEX "campaign_stats_tenant_id_idx" ON "campaign_stats"("tenant_id");
+
+-- AddForeignKey
+ALTER TABLE "campaign_stats" ADD CONSTRAINT "campaign_stats_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

packages/database/prisma/migrations/20260828160500_call_attempts_campaign_stats_rls/migration.sql

@@ -0,0 +1,10 @@
+-- Tabelas de negocio tenant-scoped: RLS obrigatorio em todas (ver docs/TENANT_ISOLATION.md).
+ALTER TABLE "call_attempts" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "call_attempts" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "tenant_isolation" ON "call_attempts"
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);
+
+ALTER TABLE "campaign_stats" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "campaign_stats" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "tenant_isolation" ON "campaign_stats"
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid);