Fix mobile registration: inject transport-tls when missing from pjsip.conf

pjsip.conf is intentionally preserved across container restarts to protect
device configurations.  When the file was created by an older version of the
setup script, or by the non-Docker bare-metal installer, it has no
[transport-tls] section.  Asterisk then starts without a TLS transport,
silently, which means nothing listens on port 5061 — causing every mobile
client configured for TLS to fail registration while the server appears
otherwise healthy.

The entrypoint now checks for the presence of [transport-tls] in an existing
pjsip.conf and injects the section (with current NAT/cert settings) if it is
absent.  A fresh install is unaffected because pjsip.conf is generated from
scratch with the TLS transport included.

https://claude.ai/code/session_01PTzYWkePEG3tDCMSLfWrXE

docker/entrypoint.sh

@@ -259,6 +259,28 @@ if [[ -f /etc/asterisk/pjsip.conf ]]; then
     fi
 fi
 
+# ── Ensure transport-tls exists in pjsip.conf (upgrade / migration path) ──
+# If pjsip.conf was preserved from a pre-TLS config or a non-Docker install it
+# will have no [transport-tls] section.  Asterisk starts without TLS silently,
+# and mobile devices cannot register.  Inject the section when it is absent.
+if [[ -f /etc/asterisk/pjsip.conf ]] && ! grep -q "^\[transport-tls\]" /etc/asterisk/pjsip.conf; then
+    log_info "transport-tls missing from pjsip.conf — adding TLS transport (required for mobile registration)..."
+    cat >> /etc/asterisk/pjsip.conf << EOF
+
+[transport-tls]
+type=transport
+protocol=tls
+bind=0.0.0.0:5061
+cert_file=/etc/asterisk/certs/server.crt
+priv_key_file=/etc/asterisk/certs/server.key
+ca_list_file=/etc/ssl/certs/ca-certificates.crt
+method=tlsv1_2
+${nat_settings}
+
+EOF
+    chown asterisk:asterisk /etc/asterisk/pjsip.conf
+fi
+
 # ── rtp.conf (always regenerated - includes TURN credentials) ──
 log_info "Configuring RTP with ICE + STUN + TURN..."
 cat > /etc/asterisk/rtp.conf << EOF