Remote phones over VPN

VPN-capable phones get a client certificate during provisioning and tunnel home — no port forwarding, no SIP ALG headaches.

Skeleton — this outline is the writing plan; content lands in the docs phase.

How the phone VPN works