Initial build: Asterisk voicemail transcription + portal

- mailcmd replacement (vm_mailcmd.py): faster-whisper transcription (CPU int8),
  extractive summary + intent tags + spoken-digit number extraction,
  multipart/alternative HTML email, fail-safe relay of original message
- Telegram DM delivery (vm_telegram.py) with per-mailbox routing
- Caller-ID -> name (vm_contacts.py): file / google / carddav backends
- SQLite store (vm_store.py) with content-addressed audio
- FastAPI portal (vm_web.py): PIN login, list/play/delete, per-user settings,
  zero JS, loopback-only behind Apache TLS
- Backfill importer (vm_import.py) for existing spool recordings
- systemd unit, Apache vhost + certbot TLS, install.sh
- Docs: INSTALL, CONFIGURATION, ARCHITECTURE, OPERATIONS, SECURITY, TESTING

Verified end-to-end on mail.txt3.net: 157 historical messages backfilled,
live voicemail -> transcribed -> stored -> visible at https://vm.txt3.net.

systemd/vm-portal.service

@@ -0,0 +1,43 @@
+[Unit]
+Description=Voicemail portal (transcripts, playback, per-mailbox settings)
+Documentation=file:/opt/vm-transcribe/vm_web.py
+After=network.target
+Wants=network.target
+
+[Service]
+Type=simple
+# Runs as asterisk so it can read voicemail.conf and the spool.
+User=asterisk
+Group=asterisk
+WorkingDirectory=/opt/vm-transcribe
+
+Environment=VM_DB=/var/lib/vm-transcribe/voicemail.db
+Environment=VM_AUDIO_DIR=/var/lib/vm-transcribe/audio
+Environment=VM_ASTERISK_CONF=/etc/asterisk/voicemail.conf
+Environment=VM_SESSION_HOURS=12
+Environment=PYTHONUNBUFFERED=1
+
+ExecStart=/opt/vm-transcribe/venv/bin/python -m uvicorn vm_web:app \
+    --host 127.0.0.1 --port 8099 \
+    --proxy-headers --forwarded-allow-ips 127.0.0.1 \
+    --log-level info
+
+Restart=on-failure
+RestartSec=3
+
+# --- hardening ---------------------------------------------------------
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+# Only these paths need to be writable.
+ReadWritePaths=/var/lib/vm-transcribe /var/log/asterisk
+# Loopback only; Apache is the only client.
+IPAddressAllow=localhost
+IPAddressDeny=any
+
+[Install]
+WantedBy=multi-user.target