Fix ACK loss from enumeration detection false-positives

Resolves production issue where legitimate ACK messages were triggering
enumeration detection, causing calls to die at ~64s (Timer H expiry).

### Root Cause:
ACK messages lack dialog-aware fast-path in l4handler.go. All SIP requests
go through the full security pipeline including enumeration detection.

When a client sends multiple ACKs (responding to 200 OK retransmissions),
the enumeration detector sees "rapid fire" extension probing and bans the
source IP.

### The Fix:
Exempt ACK from enumeration detection (l4handler.go:254-258):
- ACK is a mid-dialog request, not an extension probe
- ACKs arrive in response to 200 OK retransmissions (RFC 3261)
- False-positive rapid-fire/sequential detection blocked legitimate traffic

### Impact:
- **For Twilio trunk:** Whitelisting is the operational fix
- **For dynamic IP clients:** This architectural fix enables calls to work
  (residential users, mobile clients, peer-to-peer scenarios)

### Agent Thread Protocol:
Added docs/agent-threads/ for cross-project debugging:
- 001-flextel-ack-being-dropped.md — Problem report from asterpbx agent
- 002-diagnosis-ack-not-fast-pathed.md — Root cause analysis and fix options
- PROTOCOL.md — Agent communication protocol documentation

See: docs/agent-threads/ack-loss-from-twilio-trunk/ for full diagnosis

### Test Results:
All 196 tests passing ✅ (1.213s)

l4handler.go

@@ -248,10 +248,14 @@ func (h *SIPHandler) Handle(cx *layer4.Connection, next layer4.Handler) error {
 		}
 
 		// Check for extension enumeration attacks
-		extension := ExtractTargetExtension(buf)
-		if extension != "" {
-			detector := GetEnumerationDetector(h.logger)
-			result := detector.RecordAttempt(host, extension)
+		// Skip enumeration detection for ACK - it's a mid-dialog request, not enumeration
+		// ACKs arrive in response to 200 OK retransmissions and would trigger false-positive
+		// rapid-fire/sequential detection. See: docs/agent-threads/ack-loss-from-twilio-trunk/
+		if method != "ACK" {
+			extension := ExtractTargetExtension(buf)
+			if extension != "" {
+				detector := GetEnumerationDetector(h.logger)
+				result := detector.RecordAttempt(host, extension)
 			if result.Detected {
 				h.logger.Warn("Enumeration attack detected",
 					zap.String("ip", host),
@@ -288,7 +292,8 @@ func (h *SIPHandler) Handle(cx *layer4.Connection, next layer4.Handler) error {
 					UpdateEnumerationTrackedIPs(trackedIPs)
 				}
 			}
-		}
+			}
+		} // End ACK exemption from enumeration detection
 
 		// Check for suspicious patterns in the SIP message
 		suspiciousPattern := detectSuspiciousPattern(buf)