feat(voice): self-hosted speech recognition via Whisper (STT_*)

- STT_URL switches voice input to an OpenAI-compatible Whisper server
  (e.g. speaches); without it the browser's recognition stays. Configured
  by environment only, with limits for upload size, parallel jobs, hourly
  budget per user and timeout. The demo always uses the browser.
- POST /voice/transcribe forwards recordings and returns the text; nothing
  is stored. On startup MindSift waits for the server and asks it to
  download the model if missing.
- Admin card shows the active mode and server state, with a test recording.
- docker-compose: optional "whisper" service (speaches 0.8.3 CPU, profile
  "whisper", models in ./whisper).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/AdminSettingsView.tsx

@@ -29,6 +29,7 @@ import { passwordProblem } from '../../lib/password';
 import { UserAvatar } from '../../components/UserAvatar';
 import { ToggleSwitch } from '../../components/ToggleSwitch';
 import { BackupAdminCard } from './BackupAdminCard';
+import { VoiceStatusCard } from './VoiceStatusCard';
 import { CountBadge } from '../../components/CountBadge';
 
 interface AdminSettingsViewProps {
@@ -1115,6 +1116,8 @@ export const AdminSettingsView: React.FC<AdminSettingsViewProps> = ({
 
                   <BackupAdminCard settings={settings} onSave={(patch) => handleSaveSystemSettings(patch)} />
 
+                  <VoiceStatusCard />
+
                   {/* Alarm webhooks into the local network (SSRF protection) */}
                   <div className="p-4 bg-canvas border border-border rounded-card flex items-center justify-between gap-4">
                     <div className="pr-4">