Added
- Wildix click-to-call integration. Settings → Integrations → Wildix now stores the WMS domain and a Vault-backed WMS token, then exposes a workspace toggle for the call surface.
- Inbox phone-number call buttons. When enabled, direct-conversation phone numbers above the chat pane and in the contact bio pane become Wildix call buttons that request a PBX call for the authenticated operator.
Security
- The Wildix WMS token never reaches the browser. The call route reads it server-side from workspace Vault, derives workspace/operator identity from the authenticated session, requires a confirmed operator email, and resolves the Wildix extension by exact operator email.
- The call route binds the request to the workspace-scoped visible conversation phone number and rejects group or arbitrary destinations before reading the token.
- The settings route rejects credential-bearing query strings and stores only the normalized
*.wildixin.comdomain in workspace integration metadata.
Verification
- Route and component coverage for settings persistence, disabled integration gating, exact-email extension resolution, visible-number call launch, arbitrary-destination rejection, group gating, and failed-toggle rollback.