feat(onboarding/phase-1): admin-editable telephony, ai, and setup-state config

Phase 1 of hospital onboarding & self-service plan
(docs/superpowers/plans/2026-04-06-hospital-onboarding-self-service.md).

Backend foundations to support the upcoming staff-portal Settings hub and
6-step setup wizard. No frontend in this phase.

New config services (mirroring ThemeService / WidgetConfigService):
- SetupStateService    — tracks completion of 6 wizard steps; isWizardRequired()
                         drives the post-login redirect
- TelephonyConfigService — Ozonetel + Exotel + SIP, replaces 8 env vars,
                           seeds from env on first boot, masks secrets on GET,
                           '***masked***' sentinel on PUT means "keep existing"
- AiConfigService      — provider, model, temperature, system prompt addendum;
                         API keys remain in env

New endpoints under /api/config:
- GET  /api/config/setup-state                returns state + wizardRequired flag
- PUT  /api/config/setup-state/steps/:step    mark step complete/incomplete
- POST /api/config/setup-state/dismiss        dismiss wizard
- POST /api/config/setup-state/reset
- GET  /api/config/telephony                  masked
- PUT  /api/config/telephony
- POST /api/config/telephony/reset
- GET  /api/config/ai
- PUT  /api/config/ai
- POST /api/config/ai/reset

ConfigThemeModule is now @Global() so the new sidecar config services are
injectable from AuthModule, OzonetelAgentModule, MaintModule without creating
a circular dependency (ConfigThemeModule already imports AuthModule for
SessionService).

Migrated 11 env-var read sites to use the new services:
- ozonetel-agent.service: exotel API + ozonetel did/sipId via read-through getters
- ozonetel-agent.controller: defaultAgentId/Password/SipId via getters
- kookoo-ivr.controller: sipId/callerId via getters
- auth.controller: OZONETEL_AGENT_PASSWORD (login + logout)
- agent-config.service: sipDomain/wsPort/campaignName via getters
- maint.controller: forceReady + unlockAgent
- ai-provider: createAiModel and isAiConfigured refactored to pure factories
  taking AiProviderOpts; no more ConfigService dependency
- widget-chat.service, recordings.service, ai-enrichment.service,
  ai-chat.controller, ai-insight.consumer, call-assist.service: each builds
  the AI model from AiConfigService.getConfig() + ConfigService API keys

Hot-reload guarantee: every consumer reads via a getter or builds per-call,
so admin updates take effect without sidecar restart. WidgetChatService
specifically rebuilds the model on each streamReply().

Bug fix bundled: dropped widget.json.hospitalName field (the original
duplicate that started this whole thread). WidgetConfigService now reads
brand.hospitalName from ThemeService at the 2 generateKey call sites.
Single source of truth for hospital name is workspace branding.

First-boot env seeding: TelephonyConfigService and AiConfigService both
copy their respective env vars into a fresh data/*.json on onModuleInit if
the file doesn't exist. Existing deployments auto-migrate without manual
intervention.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/ozonetel/ozonetel-agent.service.ts

@@ -1,20 +1,27 @@
 import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
 import axios from 'axios';
+import { TelephonyConfigService } from '../config/telephony-config.service';
 
 @Injectable()
 export class OzonetelAgentService {
     private readonly logger = new Logger(OzonetelAgentService.name);
-    private readonly apiDomain: string;
-    private readonly apiKey: string;
-    private readonly accountId: string;
     private cachedToken: string | null = null;
     private tokenExpiry: number = 0;
 
-    constructor(private config: ConfigService) {
-        this.apiDomain = config.get<string>('exotel.subdomain') ?? 'in1-ccaas-api.ozonetel.com';
-        this.apiKey = config.get<string>('exotel.apiKey') ?? '';
-        this.accountId = config.get<string>('exotel.accountSid') ?? '';
+    constructor(private telephony: TelephonyConfigService) {}
+
+    // Read-through getters so admin updates to telephony.json take effect
+    // immediately without a sidecar restart. The default for apiDomain is
+    // preserved here because the legacy env-var path used a different default
+    // ('in1-ccaas-api.ozonetel.com') than the rest of the Exotel config.
+    private get apiDomain(): string {
+        return this.telephony.getConfig().exotel.subdomain || 'in1-ccaas-api.ozonetel.com';
+    }
+    private get apiKey(): string {
+        return this.telephony.getConfig().exotel.apiKey;
+    }
+    private get accountId(): string {
+        return this.telephony.getConfig().exotel.accountSid;
     }
 
     private async getToken(): Promise<string> {
@@ -196,7 +203,7 @@ export class OzonetelAgentService {
         disposition: string;
     }): Promise<{ status: string; message?: string; details?: string }> {
         const url = `https://${this.apiDomain}/ca_apis/DispositionAPIV2`;
-        const did = process.env.OZONETEL_DID ?? '918041763265';
+        const did = this.telephony.getConfig().ozonetel.did;
 
         this.logger.log(`Set disposition: agent=${params.agentId} ucid=${params.ucid} disposition=${params.disposition}`);
 
@@ -232,8 +239,9 @@ export class OzonetelAgentService {
         conferenceNumber?: string;
     }): Promise<{ status: string; message: string; ucid?: string }> {
         const url = `https://${this.apiDomain}/ca_apis/CallControl_V4`;
-        const did = process.env.OZONETEL_DID ?? '918041763265';
-        const agentPhoneName = process.env.OZONETEL_SIP_ID ?? '523590';
+        const tcfg = this.telephony.getConfig().ozonetel;
+        const did = tcfg.did;
+        const agentPhoneName = tcfg.sipId;
 
         this.logger.log(`Call control: action=${params.action} ucid=${params.ucid} conference=${params.conferenceNumber ?? 'none'}`);