feat(trunk): CallControlClient trait + MockCallControlClient + TwilioCredentials (slice-5 T2)

The provider call-control seam (green zone, ADR-0008). The trait locks the
boundary so the next provider (Telnyx, etc.) is an implementation, not a
refactor. MockCallControlClient is the CI test double; the live
TwilioCallControlClient (T6) lives behind the twilio-live feature flag.

TwilioCredentials lives ONLY in crates/rutster-trunk/ -- never re-exported
through the workspace (ADR-0009 -- provider credentials never reach the
brain). Its Debug impl is hand-written (NOT derived) so the auth_token
renders as <redacted>, never leaking into tracing/panic output.

Option<SpendToken> on originate is the pre-paved seam for spearhead step-6
(spend cap); this slice passes None everywhere. The signature is locked so
step 6 is additive, not a refactor.

T2 of slice-5. lib.rs gains `pub mod provider;` -- stacked-branches carve-out
(rebase-merge, not squash) per AGENTS.md Git workflow; dev-c rebases forward
for the FOB-side pub mod declarations (g711/twilio_media_streams/session/
loop_driver).

Signed-off-by: Aaron D. Lee <himself@adlee.work>

Cargo.lock

@@ -1280,6 +1280,11 @@ dependencies = [
 [[package]]
 name = "rutster-trunk"
 version = "0.0.0"
+dependencies = [
+ "async-trait",
+ "tokio",
+ "url",
+]
 
 [[package]]
 name = "ryu"