feat: add SQLite-backed transcription jobs

[1074016045]

Summary

This PR replaces synchronous Uploaded Audio transcription with a SQLite-backed asynchronous transcription job pipeline.

Added

• Persistent transcription jobs with queued, running, completed, failed, and cancelled states
• Atomic enqueueing with action-ID idempotency
• SQLite lease-based job claiming
• Bounded retries and expired-lease recovery
• Local non-production transcription worker
• Provider attempt timeout with stale-output rejection
• Atomic transcript, session, asset, and job completion
• Transactional cancellation during asset and session deletion
• Uploaded Audio UI polling and public job summaries
• Explicit worker feature flag, disabled by default
• Migration handling for legacy transcribing assets

Concurrency and recovery

• Separate workers cannot successfully claim the same job
• Lease tokens protect completion and failure writes
• Expired leases are recoverable
• Provider calls may run more than once after crashes
• Committed transcript effects remain exactly once
• Provider and filesystem work remain outside SQLite transactions

Safety and privacy

• No real transcription provider is included
• Fake transcription remains non-production and network-free
• Worker startup is disabled by default
• Worker never starts in production
• No microphone, system-audio, or tab capture
• No diarization
• No answer generation or scoring
• No storage paths, lease tokens, action IDs, transcript text, provider payloads, or raw database errors are exposed publicly

Migration

• Added 0006_common_punisher.sql
• Added uploaded_audio_transcription_jobs
• Preserves migrations 0000–0005 unchanged
• Performs no speculative job backfill
• Converts legacy transcribing assets to a safe interrupted failure state

Verification

• ESLint passed
• TypeScript typecheck passed
• Vitest: 28 files, 281 tests passed
• Question Boundary evaluation: 37 fixtures, 100% accuracy/F1
• Question Understanding evaluation: 56 fixtures, 95.26% dimension micro-F1
• Playwright: 6 tests passed
• Production build passed
• Migration regeneration produced no additional migration
• pnpm-lock.yaml unchanged
• Migrations 0000–0005 unchanged
• git diff --check passed

Known limitations

• No real transcription provider
• No production worker
• Requires a long-lived local Node process
• No external queue, Redis, authentication, or object storage
• Cancellation rejects stale output but cannot guarantee already-running provider code immediately stops
• Broader React component and browser E2E coverage remains future work