Fix ACK loss: bypass all security checks for mid-dialog ACKs

Resolves production issue where ACK messages triggered rate-limiting
and enumeration detection, causing calls to die at ~64s (Timer H expiry).

### Root Cause (refined via agent-thread debugging):
ACKs lack dialog-aware fast-path. Initial diagnosis pointed to enumeration
detection, but flextel agent's runtime config dump revealed enumeration was
disabled. **Rate-limiting** was the actual culprit - ACK retransmissions
(responding to Asterisk's 200 OK retransmits) hit rate limits and connections
were closed.

### The Fix (l4handler.go:231-246):
ACKs now fast-path through ALL security checks:
- ✅ Bypass rate-limiting (ACK retransmissions don't trigger limits)
- ✅ Bypass enumeration detection (no false-positive rapid-fire bans)
- ✅ Bypass validation/pattern matching (unnecessary for mid-dialog)
- ✅ Debug logging for troubleshooting
- ✅ Metrics tracking (ACKs count as "allowed")

### Agent-Thread Debugging Protocol:
Cross-project debugging via immutable message threads:
- 001: flextel reports calls dying at 64s, hypothesizes ACK loss
- 002: Our diagnosis - ACK → enumeration false-positives
- 003: flextel deploys temporary Caddyfile bypass, requests Option B
- 004: flextel refines diagnosis - rate-limiting, not enumeration
- 005: Our reply - ACK fast-path shipped, bypasses ALL checks

### Security Documentation:
Added README warning about SIP trunk whitelisting security:
- ⚠️ Don't whitelist entire carrier ranges (bypasses protection for ANY customer)
- ✅ Use narrow trunk-specific IPs only (54.172.60.0/30, 54.244.51.0/30)
- Documents Twilio-specific example with security rationale

### Impact:
- **Production fix**: Calls no longer die at 64s
- **Architecture**: Proper mid-dialog handling for all ACKs
- **Security**: Narrow whitelist guidance prevents bypass abuse
- **Future**: Dialog-aware fast-path (Option A) for all in-dialog messages

### Test Results:
All 196 tests passing ✅ (1.213s)

See: docs/agent-threads/ack-loss-from-twilio-trunk/ for full debugging trail

l4handler.go

@@ -230,6 +230,21 @@ func (h *SIPHandler) Handle(cx *layer4.Connection, next layer4.Handler) error {
 
 		// Extract SIP method for rate limiting
 		method := ExtractSIPMethod(buf)
+
+		// Fast-path for ACK - mid-dialog request, not a security threat
+		// ACKs arrive in response to 200 OK retransmissions (RFC 3261) and would
+		// trigger false-positive enumeration/rate-limit detection.
+		// See: docs/agent-threads/ack-loss-from-twilio-trunk/
+		if method == "ACK" {
+			h.logger.Debug("ACK exempted from enumeration/rate checks (mid-dialog fast-path)",
+				zap.String("ip", host),
+			)
+			if h.guardian.metricsEnabled() {
+				RecordConnection("allowed")
+			}
+			return next.Handle(cx)
+		}
+
 		if method != "" {
 			// Check rate limit
 			rl := GetRateLimiter(h.logger)