Initial build: Asterisk voicemail transcription + portal

- mailcmd replacement (vm_mailcmd.py): faster-whisper transcription (CPU int8),
  extractive summary + intent tags + spoken-digit number extraction,
  multipart/alternative HTML email, fail-safe relay of original message
- Telegram DM delivery (vm_telegram.py) with per-mailbox routing
- Caller-ID -> name (vm_contacts.py): file / google / carddav backends
- SQLite store (vm_store.py) with content-addressed audio
- FastAPI portal (vm_web.py): PIN login, list/play/delete, per-user settings,
  zero JS, loopback-only behind Apache TLS
- Backfill importer (vm_import.py) for existing spool recordings
- systemd unit, Apache vhost + certbot TLS, install.sh
- Docs: INSTALL, CONFIGURATION, ARCHITECTURE, OPERATIONS, SECURITY, TESTING

Verified end-to-end on mail.txt3.net: 157 historical messages backfilled,
live voicemail -> transcribed -> stored -> visible at https://vm.txt3.net.

CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+## 1.0.0 — 2026-08-13
+
+Initial build on mail.txt3.net (Debian 12, Asterisk 20, Apache 2.4, Postfix).
+
+- **Transcription**: per-voicemail `mailcmd` (`vm_mailcmd.py`) transcribes the
+  attached recording with faster-whisper `base.en` (CPU, int8, VAD-filtered).
+- **Summarisation**: local extractive summariser with intent tags and spoken-
+  digit callback-number extraction. No LLM, by choice.
+- **Email**: rebuilt `multipart/alternative` notification (plain + styled HTML)
+  with the recording attached; relays the original Asterisk message unchanged on
+  any error (fail-safe).
+- **Telegram** (optional): per-mailbox routed voice-note DM with summary caption
+  and transcript follow-up; degrades sendVoice → sendDocument → sendMessage.
+- **Contacts** (optional): caller-ID → name via `file` (vCard/CSV export),
+  `google` (People API OAuth), or `carddav` (app password; Nextcloud/Fastmail/
+  iCloud). Last-9-digit matching. Note: Google app passwords do not work.
+- **Web portal**: FastAPI app at `https://vm.txt3.net` — PIN login (mailbox +
+  voicemail PIN from `voicemail.conf`), list, play, download, delete, per-user
+  settings. Zero JavaScript, `script-src 'none'` CSP, loopback-only backend
+  behind an Apache TLS reverse proxy. Brute-force lockout per (mailbox, IP).
+- **Storage**: SQLite store with content-addressed audio (decoupled from
+  Asterisk's renumbering) and DB-backed sessions.
+- **Backfill**: `vm_import.py` imports and transcribes existing spool recordings;
+  idempotent on `(mailbox, origtime, callerid)`. Backfilled 157 historical
+  messages on first run (3m40s, 0 failures).
+- **Packaging**: venv at `/opt/vm-transcribe`, systemd `vm-portal.service`,
+  Apache vhost + certbot TLS, `install.sh`.