feat(voice): first-class voice input and local TTS across web, desktop, and mobile (#2018)

Complete rebuild of voice input on a server-authoritative streaming
architecture, replacing the legacy Web Speech / whole-blob / WASM engines
and the dead voice-agent layer (~4k lines removed).

Speech-to-text (dictation):
- Client streams 16 kHz mono PCM16 chunks over /api/dictation/ws with
  seq/ack ordering; buffered audio is retained and replayed on reconnect
- Server transcribes and streams live partial transcripts back;
  segments auto-commit every ~15s with silence suppression and adaptive
  finalization timeouts
- Local provider (default, zero config): sherpa-onnx models in a forked
  worker process — auto-download with progress, staged extraction with
  verification, corrupt-model auto-recovery, idle shutdown after 5 min
- Model catalog with settings picker (accuracy/speed ratings, sizes,
  download/delete): Parakeet TDT v2 (English) and v3 (25 European
  languages, auto-detected), Whisper base and tiny (multilingual, light)
- OpenAI-compatible provider for any Whisper endpoint
- Composer overlay with live transcript, volume meter, timer, and
  cancel / insert / insert-and-send actions; failed transcriptions keep
  their audio for retry or accepting the partial text as-is
- Configurable keyboard shortcut (default mod+alt+v) toggles dictation;
  Enter confirms and Escape cancels while recording
- Overlay is pixel-aligned with the composer (measured footer height,
  matching paddings/typography/gaps) — no layout shift when toggling

Text-to-speech:
- Local Kokoro provider (English, 11 voices) synthesized in the same
  worker via /api/dictation/tts/speak, managed by the shared model
  pipeline; sentence-pipelined playback keeps time-to-first-audio at
  ~1 sentence regardless of message length, and stop cancels in-flight
  synthesis
- Sanitizer keeps inline-code content (strips backticks only), reads
  interword slashes aloud, and removes only absolute file paths

Settings:
- Voice page unified: a single read-aloud toggle owns all playback
  options (the confusing "Enable Voice Mode" is gone); a new "Enable
  voice input" toggle (default on, persisted to settings.json) hides
  the composer mic entirely when disabled

Mobile and transport:
- iOS/Android microphone permissions added (dictation was previously
  impossible on mobile)
- Fixed Android WebSocket upgrades: the Capacitor WebView origin
  (https://localhost) was missing from the packaged-client allowlist,
  403-ing every WS connection — root cause of the old mobile SSE lock,
  which is now removed for all transports

Security and conventions:
- All HTTP routes sit behind the global /api auth gate; the WS upgrade
  explicitly validates the UI session and origin, with oc_url_token
  narrowly allowlisted and covered by tests; the dictation socket mints
  a fresh URL token before connecting
- Routes register before the generic OpenCode proxy; the client goes
  through runtimeFetch/getRuntimeUrlResolver, and runtime switches
  reset the dictation socket
- VS Code deliberately reports dictation as unavailable (no server
  process in that runtime)

CI: workflow Node bumped 20 -> 22 to match the repo engines and fix
better-sqlite3 installs broken by node-gyp@latest on Node 20.

New dependency: sherpa-onnx-node (prebuilt N-API; macOS/Linux x64+arm64,
Windows x64 — Windows-on-ARM falls back to the OpenAI-compatible provider)

packages/ui/src/lib/i18n/messages/zh-TW.settings.ts

@@ -1401,16 +1401,33 @@
   'settings.notifications.page.toast.backgroundDisabled': '背景通知已關閉',
   'settings.notifications.page.testNotification.title': '測試通知',
   'settings.notifications.page.testNotification.body': '這是來自 OpenChamber 的測試通知。',
-  'settings.voice.page.section.voiceSetup': '語音設定',
   'settings.voice.page.section.speechRecognition': '語音辨識',
+  'settings.voice.page.field.enableVoiceInput': '啟用語音輸入',
+  'settings.voice.page.field.enableVoiceInputAria': '啟用語音輸入（聽寫）',
   'settings.voice.page.section.playbackAndSummary': '播放',
-  'settings.voice.page.field.enableVoiceModeAria': '啟用語音模式',
-  'settings.voice.page.field.enableVoiceMode': '啟用語音模式',
   'settings.voice.page.field.provider': '提供方',
   'settings.voice.page.provider.browser': '瀏覽器',
   'settings.voice.page.provider.custom': '自訂',
   'settings.voice.page.provider.say': 'Say',
   'settings.voice.page.provider.server': '伺服器',
+  'settings.voice.page.provider.local': '本機',
+  'settings.voice.page.tooltip.sttLocal': '在 OpenChamber 伺服器上本機轉寫。模型會自動下載，無需 API 金鑰。',
+  'settings.voice.page.tooltip.localTts': '在 OpenChamber 伺服器上本機合成語音（Kokoro，英文）。模型會自動下載，無需 API 金鑰。',
+  'settings.voice.page.stt.model.parakeetV2': 'Parakeet v2（英文）',
+  'settings.voice.page.stt.model.parakeetV3': 'Parakeet v3（25 種歐洲語言）',
+  'settings.voice.page.stt.model.whisperBase': 'Whisper base（多語言）',
+  'settings.voice.page.stt.model.whisperTiny': 'Whisper tiny（多語言）',
+  'settings.voice.page.stt.badge.bestForEnglish': '英文最佳',
+  'settings.voice.page.stt.badge.bestForMultilingual': '多語言最佳',
+  'settings.voice.page.stt.meta.accuracy': '準確度',
+  'settings.voice.page.stt.meta.speed': '速度',
+  'settings.voice.page.stt.modelInstalled': '模型已安裝',
+  'settings.voice.page.stt.modelDownloading': '正在下載模型...',
+  'settings.voice.page.stt.modelDownloadingProgress': '正在下載模型... {percent}%',
+  'settings.voice.page.stt.modelNotInstalled': '模型未下載',
+  'settings.voice.page.stt.modelDownload': '下載',
+  'settings.voice.page.stt.modelDelete': '刪除模型',
+  'settings.voice.page.stt.modelRetry': '重試',
   'settings.voice.page.provider.wasm': '本機',
   'settings.voice.page.stt.wasmModel': 'Whisper 模型',
   'settings.voice.page.stt.wasmLoaded': '模型已載入',