feat: add hardened uploaded audio workflow

[1074016045]

Summary

Adds the Uploaded Audio v0.4 workflow to Transcript Lab.

• Explicit audio upload and transcription actions
• One declared speaker role per file
• Deterministic fake transcription provider for development and tests
• Final transcript ingestion into the existing Question Boundary and Question Understanding pipeline
• Persistent uploaded-audio metadata with filesystem byte storage
• Durable and retryable audio deletion using tombstones
• Atomic transcript ingestion and asset completion
• Safe defaults with uploaded audio and fake transcription disabled by default

Security and privacy

• Same-origin checks for mutations
• No-store API responses
• Bounded multipart uploads using validated Content-Length
• MIME, extension, file-signature, size, UUID, containment, and symlink validation
• Random server-side filenames
• Restrictive filesystem permissions
• Audio bytes remain outside SQLite
• No audio, transcript, provider payload, path, or secret logging
• No external transcription provider
• No microphone, system audio, tab capture, diarization, answer generation, scoring, or covert functionality

Deletion consistency

Introduces a durable deletion protocol:

planned → metadata_deleted → completed

• Stages files using server-generated tombstone paths
• Supports retries after staging, database, rollback, and final unlink failures
• Preserves committed transcript segments after audio deletion
• Prevents uploads during active session deletion
• Prevents deletion during active transcription
• Enforces action-ID ownership and guarded repository state transitions

Database

Adds migration:

• 0005_left_amazoness.sql

Adds:

• uploaded_audio_assets
• uploaded_audio_actions
• uploaded_audio_deletion_batches
• uploaded_audio_deletion_files
• transcript_segments.source_uploaded_audio_asset_id
• ON DELETE SET NULL
• Source-link index
• Uploaded-audio and deletion-state CHECK constraints

Migrations 0000–0004 and pnpm-lock.yaml are unchanged.

Verification

• Focused Uploaded Audio tests: 62 passed
• Full Vitest suite: 24 files, 242 tests passed
• Playwright: 6 tests passed
• Question Boundary evaluation: 37 fixtures, 100%
• Question Understanding evaluation: 56 fixtures, 95.26% dimension micro-F1
• Lint passed
• Typecheck passed
• Production build passed
• db:generate reported no schema changes
• git diff --check passed
• Manual upload/transcribe/refresh/evaluate/delete smoke test passed