fix: production hardening — critical issues for 24/7 deployment

[johnoct]

Summary

Fixes 5 critical and 3 high-severity issues identified during production readiness review:

Critical fixes:

• MJPEG stream generator now handles GeneratorExit to prevent leaked threads on client disconnect
• Web server uses waitress (production WSGI) instead of Flask dev server, with fallback
• Audio monitor health check in main loop — detects dead thread, notifies user, disables audio
• Audio callback race condition fixed — all calibration state mutations now under lock
• CPU spin on camera frame failures — added time.sleep(0.1) before continue

High fixes:

• snap_path initialized to None to prevent potential UnboundLocalError
• cv2.waitKey only called when preview window is active (fixes headless mode)
• /settings endpoint handles non-integer FPS input gracefully (no more 500 errors)

Other:

• Audio callback now logs stream status warnings (overflow, underflow)
• Bumped pyproject.toml version to 2.0.0
• Added waitress to dependencies (requirements.txt, pyproject.toml, CI workflows)
• 15 new tests covering all fixes (189 total passing)

Test plan

• All 189 tests pass locally
• CI passes on PR
• Verify waitress serves web UI correctly
• Verify MJPEG stream cleanup on tab close
• Verify audio health notification on device disconnect