docs: add deployment validation plan and expand env config

Add comprehensive deployment and validation plan documenting a staged
bring-up approach that gates each layer on its predecessor and defers
PSTN testing until everything else is proven.

Update .env.example to reflect current configuration:
- Replace static API_TOKEN with Casdoor SSO + owner-minted PAT auth
- Add Rhema TTS settings with port-collision warning
- Add AI Receptionist settings for inbound calls
- Reconcile GATEWAY_SIP_PORT to 5060 and default SIP domain

tests/test_hold_slayer.py

@@ -260,6 +260,11 @@ class TestMockSIPEngine:
         status = await engine.get_trunk_status()
         assert status["registered"] is False
 
+        # Starting the mock engine must NOT report a registered trunk: /health
+        # requires a registered trunk to be "healthy", so a mock that claimed
+        # registration would let a gateway that cannot place calls go green.
         await engine.start()
         status = await engine.get_trunk_status()
-        assert status["registered"] is True
+        assert status["registered"] is False
+        assert status["mock"] is True
+        assert status["reason"] == "No SIP trunk configured (mock mode)"

tests/test_oauth_metadata.py

@@ -13,7 +13,12 @@ from config import get_settings
 
 
 @pytest.fixture
-async def client():
+async def client(monkeypatch):
+    # These endpoints derive their URLs from PUBLIC_BASE_URL when it is set,
+    # falling back to the request's Host header. Pin it empty so the assertions
+    # below exercise the header path and can't be overridden by a developer's
+    # real .env.
+    monkeypatch.setattr(get_settings(), "public_base_url", "")
     transport = httpx.ASGITransport(app=main.app)
     async with httpx.AsyncClient(transport=transport, base_url="http://test") as c:
         yield c