Initial build: Asterisk voicemail transcription + portal

- mailcmd replacement (vm_mailcmd.py): faster-whisper transcription (CPU int8),
  extractive summary + intent tags + spoken-digit number extraction,
  multipart/alternative HTML email, fail-safe relay of original message
- Telegram DM delivery (vm_telegram.py) with per-mailbox routing
- Caller-ID -> name (vm_contacts.py): file / google / carddav backends
- SQLite store (vm_store.py) with content-addressed audio
- FastAPI portal (vm_web.py): PIN login, list/play/delete, per-user settings,
  zero JS, loopback-only behind Apache TLS
- Backfill importer (vm_import.py) for existing spool recordings
- systemd unit, Apache vhost + certbot TLS, install.sh
- Docs: INSTALL, CONFIGURATION, ARCHITECTURE, OPERATIONS, SECURITY, TESTING

Verified end-to-end on mail.txt3.net: 157 historical messages backfilled,
live voicemail -> transcribed -> stored -> visible at https://vm.txt3.net.

apache/vm.txt3.net.conf

@@ -0,0 +1,54 @@
+<VirtualHost 51.68.212.39:80 [2001:41d0:801:2000::2245]:80>
+    ServerName vm.txt3.net
+    ErrorLog /var/log/virtualmin/vm.txt3.net_error_log
+    CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined
+
+    # Let certbot answer HTTP-01 challenges from the webroot
+    Alias /.well-known/acme-challenge/ /home/txt3/domains/vm.txt3.net/public_html/.well-known/acme-challenge/
+    <Directory /home/txt3/domains/vm.txt3.net/public_html/.well-known/acme-challenge>
+        Require all granted
+        Options -Indexes
+    </Directory>
+    ProxyPass /.well-known !
+
+    # Everything else goes to HTTPS
+    RewriteEngine on
+    RewriteCond %{HTTPS} !=on
+    RewriteRule ^/(?!\.well-known)(.*)$ https://vm.txt3.net/$1 [R=301,L]
+</VirtualHost>
+
+<VirtualHost 51.68.212.39:443 [2001:41d0:801:2000::2245]:443>
+    ServerName vm.txt3.net
+    ErrorLog /var/log/virtualmin/vm.txt3.net_error_log
+    CustomLog /var/log/virtualmin/vm.txt3.net_access_log combined
+
+    SSLEngine on
+    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+    # Replaced by certbot with the vm.txt3.net cert once issued.
+    SSLCertificateFile /etc/letsencrypt/live/vm.txt3.net/fullchain.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/vm.txt3.net/privkey.pem
+
+    # --- security headers -------------------------------------------------
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-Frame-Options "DENY"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Strict-Transport-Security "max-age=15768000"
+    # The app uses only inline <style>, no external or inline JS.
+    Header always set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; media-src 'self'; img-src 'self' data:; script-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
+
+    # --- reverse proxy to the voicemail portal ----------------------------
+    ProxyPreserveHost On
+    ProxyRequests Off
+    # Recordings can be a few MB; give uploads/streams room.
+    ProxyTimeout 120
+
+    ProxyPass        /.well-known !
+    ProxyPass        / http://127.0.0.1:8099/ retry=0
+    ProxyPassReverse / http://127.0.0.1:8099/
+
+    RequestHeader set X-Forwarded-Proto "https"
+
+    <Location />
+        Require all granted
+    </Location>
+</VirtualHost>