Separate JSON API backend (vm_api.py) + React+TanStack frontend scaffold

- vm_api.py: pure FastAPI JSON API on :8098 with CORS
- vm-api.service: systemd unit for API (replaces inline HTML vm_web.py for frontend)
- vm_web.py: kept intact as fallback; Apache now proxies /api/ -> :8098
- frontend/: Vite + React + TanStack Query scaffold
- Apache vhost updated: DocumentRoot -> frontend/dist, /api/ proxy, SPA fallback
- All original HTML pages still functional via :8099 during transition

systemd/vm-api.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Voicemail API (JSON backend for React portal)
+After=network.target mysql.service
+Wants=mysql.service
+
+[Service]
+Type=simple
+User=asterisk
+Group=asterisk
+WorkingDirectory=/opt/vm-transcribe
+ExecStart=/opt/vm-transcribe/venv/bin/uvicorn vm_api:app --host 127.0.0.1 --port 8098 --workers 2
+Restart=on-failure
+RestartSec=5
+Environment=VM_SESSION_HOURS=12
+EnvironmentFile=-/opt/vm-transcribe/api.env
+
+# Hardening
+ProtectSystem=full
+ProtectHome=read-only
+NoNewPrivileges=true
+PrivateTmp=true
+IPAddressAllow=127.0.0.1
+
+[Install]
+WantedBy=multi-user.target