fix(telephony): PiperUrl 10.0.57.15 → .17 + shared-tts hostPath for TTS playback

Piper was never reachable on 10.0.57.15 — edge1's actual address is
10.0.57.17 (SSH config, project_edge1_sdcard memory). Every telephony
prompt hit the 8s HttpClient timeout and fell back to the built-in sound
map (vm-advopts, vm-goodbye, beep) instead of speaking the real workflow
text. Verified from noc1: `curl http://10.0.57.17:8500/health` returns
HTTP 200 in 6ms, `POST /tts` returns a 16kHz mono WAV in 606ms.

Changes:

- apps/telephony/telephony.yaml
  - `Tts.PiperUrl` → `http://10.0.57.17:8500`
  - NetworkPolicy egress allow → `10.0.57.17/32:8500`
  - Header comment now documents the POST /tts {"text":"..."} contract
  - telephony-web pod mounts `/shared-tts` from hostPath `/tmp/tts-audio`
    (rke2-agent1). This is where `AsteriskProvider.SpeakTextAsync` writes
    the synthesized .sln16 before calling ARI `Play sound:tts/<name>`.

- apps/asterisk/deployment.yaml
  - Asterisk pod mounts the same hostPath at
    `/var/lib/asterisk/sounds/tts` so it can read and play what
    telephony-web wrote. Both deployments have
    `nodeSelector: kubernetes.io/hostname: rke2-agent1` so the hostPath
    is guaranteed to be the same directory.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/asterisk/deployment.yaml

@@ -106,6 +106,11 @@ spec:
               mountPath: /var/log/asterisk
             - name: sounds
               mountPath: /var/lib/asterisk/sounds/en
+            # Shared TTS audio — telephony-web writes .sln16 files here (as
+            # /shared-tts), Asterisk plays them via `sound:tts/<name>` which
+            # resolves to this mount. Both pods are pinned to rke2-agent1.
+            - name: shared-tts
+              mountPath: /var/lib/asterisk/sounds/tts
           resources:
             requests:
               cpu: 100m
@@ -177,3 +182,7 @@ spec:
           emptyDir: {}
         - name: sounds
           emptyDir: {}
+        - name: shared-tts
+          hostPath:
+            path: /tmp/tts-audio
+            type: DirectoryOrCreate

apps/telephony/telephony.yaml

@@ -1,7 +1,7 @@
 # FlowerCore.Telephony - Blazor Server + REST API + Twilio IVR
 # ArgoCD managed - BlueJay Lab
 # Credentials: 1Password → OnePasswordItem CRD → K8s Secret (twilio-credentials)
-# TTS: Piper on edge1 (10.0.57.15:8500)
+# TTS: Piper on edge1 (10.0.57.17:8500) — endpoint /tts with {"text":"..."}
 # Public: telephony.flowercore.io via Cloudflare origin cert
 ---
 apiVersion: v1
@@ -70,7 +70,7 @@ data:
         "Transport": "udp"
       },
       "Tts": {
-        "PiperUrl": "http://10.0.57.15:8500",
+        "PiperUrl": "http://10.0.57.17:8500",
         "DefaultEngine": "piper",
         "SampleRate": 8000
       },
@@ -170,6 +170,11 @@ spec:
               readOnly: true
             - name: telephony-data
               mountPath: /data
+            # Shared TTS audio — we write Piper .sln16 output here; Asterisk
+            # pod reads the same hostPath at /var/lib/asterisk/sounds/tts and
+            # plays via `sound:tts/<name>`. Both pods are pinned to rke2-agent1.
+            - name: shared-tts
+              mountPath: /shared-tts
           resources:
             requests:
               memory: 256Mi
@@ -196,6 +201,10 @@ spec:
         - name: telephony-data
           persistentVolumeClaim:
             claimName: telephony-data
+        - name: shared-tts
+          hostPath:
+            path: /tmp/tts-audio
+            type: DirectoryOrCreate
 ---
 # ClusterIP service
 apiVersion: v1
@@ -282,10 +291,10 @@ spec:
           protocol: UDP
         - port: 53
           protocol: TCP
-    # Allow Piper TTS on edge1 (10.0.57.15:8500)
+    # Allow Piper TTS on edge1 (10.0.57.17:8500)
     - to:
         - ipBlock:
-            cidr: 10.0.57.15/32
+            cidr: 10.0.57.17/32
       ports:
         - port: 8500
           protocol: TCP