Initial build: Asterisk voicemail transcription + portal

- mailcmd replacement (vm_mailcmd.py): faster-whisper transcription (CPU int8),
  extractive summary + intent tags + spoken-digit number extraction,
  multipart/alternative HTML email, fail-safe relay of original message
- Telegram DM delivery (vm_telegram.py) with per-mailbox routing
- Caller-ID -> name (vm_contacts.py): file / google / carddav backends
- SQLite store (vm_store.py) with content-addressed audio
- FastAPI portal (vm_web.py): PIN login, list/play/delete, per-user settings,
  zero JS, loopback-only behind Apache TLS
- Backfill importer (vm_import.py) for existing spool recordings
- systemd unit, Apache vhost + certbot TLS, install.sh
- Docs: INSTALL, CONFIGURATION, ARCHITECTURE, OPERATIONS, SECURITY, TESTING

Verified end-to-end on mail.txt3.net: 157 historical messages backfilled,
live voicemail -> transcribed -> stored -> visible at https://vm.txt3.net.

config/telegram.conf.example

@@ -0,0 +1,51 @@
+# /opt/vm-transcribe/telegram.conf
+#
+# Telegram delivery for voicemail notifications.
+# Reloaded on every voicemail - no restart needed after editing.
+#
+# chmod 640, owned root:asterisk - it contains a bot token.
+
+[telegram]
+# Master switch. Set to no to disable Telegram entirely (email still sends).
+enabled = yes
+
+# Bot token from @BotFather, e.g. 123456789:AAH...
+token =
+
+# Where to send when a mailbox has no [mailbox:N] section below.
+# Leave blank to send nothing for unmapped mailboxes.
+default_chat_id =
+
+# Attach the recording as a Telegram voice note (ogg/opus, plays inline).
+send_audio = yes
+
+# Include the full transcript as a follow-up message when it is longer
+# than the summary. Set to no for summary-only.
+send_transcript = yes
+
+# Seconds to wait on the Telegram API before giving up. Email is already
+# sent by this point, so a timeout is never fatal.
+timeout = 20
+
+
+# ---------------------------------------------------------------------------
+# Per-mailbox routing.  Section name is  [mailbox:<mailbox number>]
+# chat_id may be a comma-separated list to fan out to several people.
+#
+# To find a chat ID: message your bot, then visit
+#   https://api.telegram.org/bot<TOKEN>/getUpdates
+# and read result[].message.chat.id  (negative numbers are groups).
+#
+# Any key from [telegram] can be overridden per mailbox.
+# ---------------------------------------------------------------------------
+
+# [mailbox:1001]
+# chat_id = 123456789
+
+# [mailbox:1002]
+# chat_id = 987654321, 123456789
+# send_transcript = no
+
+# [mailbox:1003]
+# chat_id = -1001234567890
+# send_audio = no