stt leaves the platform for the transcribe plugin

Speech-to-text is now plugins/transcribe — sidecar, its own config, its own
skill and a task for the file browser's context menu. The transcription logic
moved BYTE FOR BYTE: 416 lines whose every decision has a reason attached, from
the two-pass detect-then-transcribe to the 25 language priming prompts to
timeout:false. Verified identical rather than assumed.

Removed here: api/stt/, server-settings/stt.ts and its mount, POST /chat/stt,
POST /file-browser/transcribe, the FileViewer handler behind the button hidden
last release, the Settings screen, the dead useAudioRecording hook and the
orphaned locale keys across all six locales.

blobToWav stayed. It lived in the same file as the dead hook and is still used
by DictateDialog — unrelated to STT, and deleting by file rather than by use is
how that would have gone.

No permission entry to remove: STT never had one, living under server-admin,
chat and files. The registry count is unchanged and docs:check is green.

The plugin ships a task that will not appear in the menu yet — the platform
loads a plugin's skills, affordances and notifications from its own directory
but not its tasks. That loader is the remaining piece of docs/plugin-capabilities.md
and is deliberately not built here.

1426 pass, tsgo clean, 18 plugins discovered with none broken.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/servers/permissions/registry.ts

@@ -5,9 +5,11 @@
 //
 // The obvious model is "list the routes a role may call". It does not survive contact with this codebase.
 // A sweep of all 100 mutating platform routes on 2026-08-06 found reads permanently stuck on POST for two
-// reasons that are not going away: bodies GET cannot carry (`/stt` multipart audio, `/tts`, `/ocr`,
-// `/transcribe`), and credentials that must not sit in a query string where access logs, shell history and
-// Referer headers capture them (`/tts/voices` apiKey, the four `/test` endpoints, `/local-providers/probe`).
+// reasons that are not going away: bodies GET cannot carry (`/tts`, `/ocr` multipart audio and images —
+// `/stt` and `/transcribe` were two more of these until 2026-08-24, when speech-to-text left for the
+// `transcribe` plugin), and credentials that must not sit in a query string where access logs, shell
+// history and Referer headers capture them (`/tts/voices` apiKey, the four `/test` endpoints,
+// `/local-providers/probe`).
 // Five genuinely free conversions were done in e54d71d; the rest are staying. So the METHOD alone cannot
 // carry the read/write distinction — hence `readOnlyWrites` below, declared per permission.
 //