Admit an outbound call a local-mode deployment will dial itself

For a self-hosted local-mode deployment, runs outbound admission, wallet reservation, call creation and bounded execution-slot allocation, then returns a single-use tca_ token and dial plan instead of enqueueing a job. Tenant/project authority comes from the deployment row; any supplied identity must agree. Caller ID must be an active number of that project. Gateway tokens require both calls:authorize and gateways:report; missing scopes and a disabled live gate refuse before reservation. Denied authorization returns no token; an idempotency replay returns the original call without a new token. Self-hosted queue-mode workers remain organization-bound. The separately operated platform_hosted mode is internal: it only authorizes an existing hosted call under its current worker lease, deriving tenant/configuration from that call, never creating a caller-selected tenant call. Platform mode is staged behind its rollout gate and is not available through customer deployment creation.