feat(libapi): add RtpSecureMediaEnum for RTP/SRTP security modes

[brancan]

Summary

This PR introduces a new RtpSecureMediaEnum to give explicit control over RTP/SRTP security in the MediaModel.

Changes

• New enum RtpSecureMediaEnum with four modes:
  • mandatory: always SRTP
  • optional: SRTP if supported by remote
  • forbidden: never SRTP
  • false: no SRTP (current default behavior)
• MediaModel extended with a rtp_secure_media field, defaulting to false to preserve backwards compatibility.

Why

The codebase already supports SRTP at the FreeSWITCH layer, but the libreapi data model lacks a first-class field to declare per-class media security policy. Exposing it via a typed Pydantic enum makes it straightforward for clients (WebUI, automation, ansible) to set it consistently and have the API validate the values.

Backward compatibility

Default false keeps the current behavior, so existing deployments are unaffected.

Test plan

• Existing tests still pass (no behavioral change when rtp_secure_media=false).
• New field accepted via API and persisted/loaded correctly.
• Reject unknown values with a Pydantic validation error.

---

Cherry-picked from a downstream deployment branch where this addition has been running for a while.

Made with Cursor

[brancan]

Gentle ping on this one — happy to make any changes if there's feedback. Let us know if there's anything blocking it.

[hnimminh]

SRTP (secured media) will be enable automatically if SIP TLS is enabled.
have you try it?

[brancan]

You're right that SRTP auto-enables today whenever SIP transport is TLS (hardcoded to mandatory in callng/main.lua). But that also exposed a gap in this PR as originally submitted: it only added the rtp_secure_media field to MediaModel, callng never actually read it. The field was a complete no-op, we confirmed it by grepping for every reference to it.

We only noticed because our own production Redis already had rtp_secure_media set per media class (mandatory/optional/forbidden) on live interconnects, clearly expecting the field to do something. It wasn't.

Pushed a commit that wires it up: inMediaProcess/outMediaProcess now read rtp_secure_media from the media class and set FreeSWITCH's variable accordingly, and the existing TLS auto-mandatory block only fires when the class is unset or false (the backward-compatible default), so it never overrides an explicit choice. That gets you real per-class control, forbidding SRTP even over TLS, or offering it as optional over plain UDP, neither of which the TLS-only path can do.

Validated with a standalone Lua harness (mocked rdbconn/DxLeg, loaded the exact function source) covering all four enum values on both legs plus the TLS-gate interaction, no FreeSWITCH process needed. Ready for another look.