feat(voice): self-hosted speech recognition via Whisper (STT_*)

- STT_URL switches voice input to an OpenAI-compatible Whisper server
  (e.g. speaches); without it the browser's recognition stays. Configured
  by environment only, with limits for upload size, parallel jobs, hourly
  budget per user and timeout. The demo always uses the browser.
- POST /voice/transcribe forwards recordings and returns the text; nothing
  is stored. On startup MindSift waits for the server and asks it to
  download the model if missing.
- Admin card shows the active mode and server state, with a test recording.
- docker-compose: optional "whisper" service (speaches 0.8.3 CPU, profile
  "whisper", models in ./whisper).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -25,3 +25,19 @@ LEGAL_IMPRINT_URL=
 LEGAL_PRIVACY_URL=
 LEGAL_IMPRINT_CONTENT_FILE=
 LEGAL_PRIVACY_CONTENT_FILE=
+
+# Optional: own speech recognition (Whisper). Without STT_URL the browser's recognition is used.
+# Enable: STT_URL=http://whisper:8000 and COMPOSE_PROFILES=whisper (starts the "whisper" service),
+# then: mkdir -p whisper && sudo chown 1000:1000 whisper && docker compose up -d
+# COMPOSE_PROFILES=whisper
+STT_URL=
+STT_MODEL=deepdml/faster-whisper-large-v3-turbo-ct2
+STT_LANGUAGE=de
+STT_API_KEY=
+STT_DISABLED=false
+# Limits (server mode)
+STT_MAX_SECONDS=600
+STT_MAX_UPLOAD_MB=25
+STT_MAX_PARALLEL=1
+STT_PER_USER_PER_HOUR=60
+STT_TIMEOUT_SECONDS=120