extract speech-to-text into its own plugin

Moves platform STT out into a plugin that owns the whole whisper.cpp contract: sidecar,
config (a JSON file under DATA_PATH/transcribe/, validated against the server before
storing), a thin proxy router, a skill so an agent knows the contract without being told,
and a script-mode file-browser task (not agentic — no model turn per audio file).

sidecar/transcribe.ts and its test moved unchanged from src/servers/api/stt/ — every
constant in it has a reason attached and none of it was touched.

The platform-side removal (routes, dead useAudioRecording path, Settings screen, locale
keys) lands in a separate, uncommitted change in the platform repo for review.

Not yet reachable from the file browser: the platform does not load tasks from a plugin's
directory yet (skills/affordances/notifications do). Ships anyway per instructions.

Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

sidecar/config.ts

@@ -0,0 +1,87 @@
+import { join } from 'node:path';
+import { mkdir } from 'node:fs/promises';
+import { DATA_PATH } from '@@/data-path';
+
+// The Whisper connection — a single URL, kept in a JSON file rather than a database row.
+//
+// There is only ever one whisper.cpp server for the whole install: unlike `photos_config` or
+// `jellyfin_servers`, nobody has a reason to keep more than one on hand, so a file the owner can also
+// edit by hand (or drop in with a provisioning script) is simpler than a table that will only ever hold
+// one row. See `plugins/music/sidecar/indexer.ts` for the same `DATA_PATH/<plugin>/` convention.
+//
+// Not committed anywhere: this file lives under DATA_PATH, outside both the platform's and this plugin's
+// git repositories. Config is data, not definition.
+
+const CONFIG_DIR = join(DATA_PATH, 'transcribe');
+const CONFIG_PATH = join(CONFIG_DIR, 'config.json');
+
+export type TranscribeConfig = { url: string };
+
+// Cached across requests; invalidated only by `setConfig`. A single small file re-read on every
+// transcription would be a needless stat + parse on the hot path.
+let cache: TranscribeConfig | null | undefined;
+
+async function loadConfig(): Promise<TranscribeConfig | null> {
+  const file = Bun.file(CONFIG_PATH);
+  if (!(await file.exists())) return null;
+  try {
+    const parsed = (await file.json()) as Partial<TranscribeConfig>;
+    return typeof parsed.url === 'string' && parsed.url ? { url: parsed.url } : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function getConfig(): Promise<TranscribeConfig | null> {
+  if (cache === undefined) cache = await loadConfig();
+  return cache;
+}
+
+export async function setConfig(config: TranscribeConfig): Promise<void> {
+  await mkdir(CONFIG_DIR, { recursive: true });
+  await Bun.write(CONFIG_PATH, JSON.stringify(config, null, 2));
+  cache = config;
+}
+
+/**
+ * The URL as the browser is allowed to see it.
+ *
+ * A whisper.cpp URL is never expected to carry credentials — the server has no auth of its own — but if
+ * an owner points this at something behind a reverse proxy with basic auth baked into the URL, userinfo
+ * (`user:pass@`) must not round-trip back out to `GET /config`. Stripped rather than trusted to stay
+ * absent.
+ */
+export function redactUrl(url: string): string {
+  try {
+    const parsed = new URL(url);
+    parsed.username = '';
+    parsed.password = '';
+    return parsed.toString();
+  } catch {
+    return url;
+  }
+}
+
+export type ProbeResult = { ok: true } | { ok: false; error: string };
+
+/**
+ * Ask a whisper.cpp server whether it is really there.
+ *
+ * Mirrors the platform's old `POST /server-settings/stt/test`: an empty multipart body to `/inference`
+ * always fails on the Whisper side, but ANY response — including its error — means the server exists and
+ * speaks the expected protocol. A network-level failure (wrong host, nothing listening, timeout) is the
+ * only thing that means "not reachable".
+ */
+export async function probeWhisper(url: string): Promise<ProbeResult> {
+  const base = url.replace(/\/+$/, '');
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 5000);
+  try {
+    await fetch(`${base}/inference`, { method: 'POST', body: new FormData(), signal: controller.signal });
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : 'could not reach the server' };
+  } finally {
+    clearTimeout(timeout);
+  }
+}