M6 + M0: hardening, deploy docs, PoC scripts

- Pipeline-down fallback: dialplan plays gogo-fallback after a failed
  AudioSocket (§15) + script to synthesize the Bosnian prompt via TTS
- Voice heartbeat file → /health/voice endpoint + live status in admin panel
- Retention job also purges stale call registrations; chat sessions metered;
  100%-usage super-admin alert email (GOGO_ADMIN_ALERT_EMAIL)
- .env.example, docs/DEPLOY.md (compose stack, GPU node, backups pg_dump,
  update procedure, security notes)
- §16 Definition of Done as an automated test: softphone-style call → fake
  partner availability → request pushed → webhook confirm → console SMS
- M0 PoC scripts: STT accuracy harness (CER/WER + spoken-digit check; dry-run
  verified with espeak-ng samples + faster-whisper small on CPU — phone number
  extracted exactly), TTS bake-off (Azure vs ElevenLabs, latency+cost), and
  end-to-end latency smoke test speaking real AudioSocket to the live pipeline

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -53,3 +53,22 @@ the **reference implementation of Appendix B** for partner IT teams:
 | `tests/fake_partner.py` | Appendix B reference implementation |
 
 All code/comments in English; all client- and owner-facing text in Bosnian (Latin).
+
+## Status (software phase complete)
+
+| Milestone | State |
+|---|---|
+| M0 PoC scripts (STT/TTS/latency) | ✅ written + dry-run; real numbers need founder recordings + API keys |
+| M1 backend core + proposal engine | ✅ |
+| M2 agent in text mode | ✅ (Appendix-A acceptance tests run when an Anthropic key is set) |
+| M3 widget + dashboard + super-admin | ✅ verified live in browser |
+| M4 voice pipeline (softphone path) | ✅ incl. real-Asterisk config validation |
+| M5 hardware layer (GSM/SMS/forwarding) | ✅ written + mock-tested; live runbook in `docs/HARDWARE_TESTING.md` |
+| M6 hardening + deploy | ✅ `docs/DEPLOY.md` |
+
+The §16 Definition of Done is an automated test: `tests/test_definition_of_done.py`.
+
+Still needed from the founder: Anthropic API key, TTS key (Azure/ElevenLabs
+bake-off via `scripts/poc/tts_bakeoff.py`), speech samples for
+`scripts/poc/stt_test.py`, GSM gateway hardware + SIMs, Google OAuth client
+(for Calendar tenants), SMTP account.