Make "Full reinstall" a real teardown for asterisk, mattermost, and coturn

Extends the security-dashboard prototype to the shared-coturn trio, since
these three are exactly the case that pattern was built for — a fresh
reinstall of any of them today just overwrote files in place without
stopping old containers first, and coturn's own fresh path never made an
informed choice about the consumer credentials/database it happens to
leave alone (safe today, but by omission rather than design).

- asterisk.sh / mattermost.sh: "Full reinstall" now stops the existing
  containers (`docker compose down`) before falling through to the normal
  install flow, and asks a single explicit question — delete stored data
  (PBX config/spool/voicemail for Asterisk; Postgres db/uploads/config/
  plugins for Mattermost) — defaulting to preserve. Their shared-coturn
  TURN credential is deliberately left alone either way (reused from
  cache via ensure_coturn_user(), same as update) — it's not this
  service's own data, and coturn already handles that continuity.
  Mattermost's existing "_db_has_data" check already reads the
  filesystem to decide whether to reuse or regenerate DB_PASS, so the
  wipe/preserve choice composes with that for free — no separate flag
  needed. Asterisk's warns to re-run pstn-trunk afterward if data is
  wiped, since that's what actually goes stale (its dialplan patch),
  not the fabricated "AMI secret" framing an earlier draft of this
  warning used before I checked the actual code.

- coturn.sh: "Full reinstall" now lists which consumers are currently
  registered (from users/*.env) and asks explicitly whether to also
  wipe TURN credentials and the user database, instead of silently
  preserving them as an unexamined side effect of never deleting the
  directory. Defaults to preserve. If the operator does choose to wipe,
  the running container is restarted afterward — it holds the old,
  now-deleted turndb file open, so new turnadmin writes to the fresh
  file would otherwise go unseen until a restart anyway. Every affected
  consumer already self-heals a missing credential on its own next
  Update run via ensure_coturn_user()'s existing cache-miss path — no
  changes needed there, just confirmed it covers this case.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/asterisk.sh

@@ -1692,7 +1692,26 @@ install_asterisk() {
                 return 0
                 ;;
             fresh)
-                log_info "Proceeding with a full fresh reinstall — every prompt below runs from scratch."
+                echo ""
+                log_warning "Full reinstall stops the existing containers and re-runs every"
+                log_warning "prompt below from scratch (domain, networking, firewall, Caddy/"
+                log_warning "Authelia). The TURN credential registered with the shared coturn"
+                log_warning "service is reused as-is — no need to touch coturn for this."
+                local _WIPE_PBX_DATA=""
+                prompt_yn "  Also delete stored PBX data (extensions, voicemail, recordings, spool)? (y/n):" "n" _WIPE_PBX_DATA
+
+                log_info "Stopping the existing containers..."
+                (cd "$EA_DIR" && docker compose down 2>/dev/null)
+
+                if [[ "$_WIPE_PBX_DATA" =~ ^[Yy]$ ]]; then
+                    rm -rf "$EA_DIR/config/asterisk" "$EA_DIR/spool" "$EA_DIR/logs" "$EA_DIR/lib"
+                    log_warning "Deleted config/asterisk, spool, logs, and lib — extensions,"
+                    log_warning "voicemail, and call recordings are gone."
+                    if declare -F install_pstn-trunk >/dev/null 2>&1 || [ -f "$EA_DIR/pstn-trunk-usage-alert.sh" ]; then
+                        log_warning "PSTN trunk patches config/asterisk's dialplan — re-run"
+                        log_warning "'sudo ./setup.sh pstn-trunk' afterward to restore it."
+                    fi
+                fi
                 ;;
         esac
     fi