Twilio Voice Status

Handle Twilio call status callbacks.

Order (strict — no workspace write before signature verify):

1. Resolve workspace_id via ?ws= query, fall back to voice_call_routing on shared DB, 404 if neither resolves.
2. Read-only load of channel_account.state.twilio_auth_token via voice_sessions on the workspace DB.
3. Validate X-Twilio-Signature over reconstructed public URL (X-Forwarded-Proto + X-Forwarded-Host + path + full query incl. ?ws=).
   • token present, signature valid → pass
   • token present, signature missing/invalid → 403
   • token absent in DB → allow + WARNING (surfaces misconfig, keeps status transitions flowing; matches /voice/incoming posture)
4. UPDATE voice_sessions on workspace session (AND workspace_id = :ws).