Motivation

• Close an authorization bypass that allowed external channels to arm/disarm phone control and persist gateway node allow/deny changes without operator.admin.

Description

• Require operator.admin for both /phone arm and /phone disarm on all channels by removing the ctx.channel === "webchat" conditional in extensions/phone-control/index.ts.
• Update extensions/phone-control/index.test.ts to assert external callers without operator.admin are blocked for both arm and disarm paths while preserving admin behavior.
• Keep existing arm/disarm behavior intact for callers that include the operator.admin scope.

Testing

• Ran the targeted unit tests with pnpm test -- extensions/phone-control/index.test.ts, and the test file passed (6 passed).
• Executed repository checks via the commit helper (scripts/committer) which runs pnpm check and linters, and they completed without errors.

Codex Task