feat: mount MCP server, add bearer auth, and guard outbound calls

The MCP server was created but never mounted — no client could reach
it. Mount it at /mcp/ over streamable HTTP with a combined lifespan,
resolving the gateway lazily so mounting happens at app construction.

Security and safety for the agent surface:
- One static API_TOKEN (SecretStr) enforced across REST (dependency),
  WebSocket (query param/header before accept), and MCP
  (StaticTokenVerifier). Startup refuses tokenless non-loopback binds.
- Emergency numbers (911/9911/112) always refused on make_call, plus a
  MAX_CONCURRENT_CALLS cap; ValueError surfaces as 400/ToolError.
- Safe defaults: debug off, no credential in default DATABASE_URL,
  SIP/LLM/TTS secrets as SecretStr.

Cleanups:
- Delete broken learn_call_flow tool (wrong ctor args, nonexistent
  method) and the never-fed CallAnalytics service; keep
  call_flow_learner for proper wiring later.
- Trim dial_plan to what is actually used (emergency guard, extension
  allocation); delete the unreferenced matcher/normaliser.
- Register call_history before calls so /api/calls/history is no
  longer shadowed by /api/calls/{call_id}.
- fastmcp pinned >=3.0 (http_app + StaticTokenVerifier).

New tests: MCP in-memory client (tool surface, lazy gateway, emergency
refusal, call cap) and API security (401 paths, route order, mount).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_services.py

@@ -3,7 +3,6 @@ Tests for the intelligence layer services:
 - LLMClient
 - NotificationService
 - RecordingService
-- CallAnalytics
 - CallFlowLearner
 """
 
@@ -286,47 +285,6 @@ class TestRecordingService:
         await svc.stop_recording("call_abc123")
 
 
-# ============================================================
-# Call Analytics Tests
-# ============================================================
-
-
-class TestCallAnalytics:
-    """Test analytics tracking."""
-
-    def _make_service(self):
-        from services.call_analytics import CallAnalytics
-
-        return CallAnalytics(max_history=1000)
-
-    def test_init(self):
-        svc = self._make_service()
-        assert svc._call_records == []
-        assert svc.total_calls_recorded == 0
-
-    def test_get_summary_empty(self):
-        svc = self._make_service()
-        summary = svc.get_summary(hours=24)
-        assert summary["total_calls"] == 0
-        assert summary["success_rate"] == 0.0
-
-    def test_get_company_stats_unknown(self):
-        svc = self._make_service()
-        stats = svc.get_company_stats("+18005551234")
-        assert stats["total_calls"] == 0
-
-    def test_get_top_numbers_empty(self):
-        svc = self._make_service()
-        top = svc.get_top_numbers(limit=5)
-        assert top == []
-
-    def test_get_hold_time_trend(self):
-        svc = self._make_service()
-        trend = svc.get_hold_time_trend(days=7)
-        assert len(trend) == 7
-        assert all(t["call_count"] == 0 for t in trend)
-
-
 # ============================================================
 # Call Flow Learner Tests
 # ============================================================