Ops hardening: lead re-import, SMS health-watch, ambient office murmur

- scripts/reimport_leads.py drains appointment_requests.jsonl into Odoo
  (fallback leads were captured but invisible to staff forever); server.py
  now warns at startup when leads are pending.
- scripts/healthwatch.sh (cron, every minute): after 3 consecutive /health
  failures sends a Twilio SMS to ALERT_SMS_TO (30-min cooldown) + a recovery
  SMS. systemd handles restarts; this makes a human aware when that isn't
  enough. Tested end-to-end (DOWN + RECOVERED SMS delivered).
- Ambient office murmur (assets/office_ambience.wav, generated by
  scripts/make_ambience.py from low-passed unintelligible Kokoro babble +
  room tone) mixed continuously into outbound audio via pipecat
  SoundfileMixer, so callers hear a live office instead of dead silence
  while the agent thinks. AMBIENT_VOLUME/AMBIENT_ENABLED to tune/disable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.py

@@ -80,6 +80,18 @@ async def lifespan(app: FastAPI):
         logger.info(f"Warmed + pinned Ollama model {model} (keep_alive=-1)")
     except Exception as e:
         logger.warning(f"LLM warmup failed (first call may be slow): {e!r}")
+    # Pending fallback leads = requests captured while Odoo was down. They are invisible
+    # to staff until drained — shout about it on every startup.
+    try:
+        from practice import REQUESTS_LOG
+        if os.path.isfile(REQUESTS_LOG) and os.path.getsize(REQUESTS_LOG) > 0:
+            n = sum(1 for ln in open(REQUESTS_LOG) if ln.strip())
+            logger.warning(
+                f"{n} lead(s) pending in {REQUESTS_LOG} — staff can't see these! "
+                f"Run: python scripts/reimport_leads.py"
+            )
+    except Exception:
+        logger.exception("fallback-lead check failed")
     yield