fix(edge): stop short clips waiting a minute on the NAS and make the OpenAI STT fallback usable

A five-second phone recording took over a minute: stt-proxy waited up to
60 s for the self-hosted gateway, whose GPU endpoint was off and whose NAS CPU
Whisper needs 30-90 s per clip. With a direct provider configured the gateway
now gets 5 s plus the clip length (30 s cap).

The direct OpenAI fallback never produced a result. The production key held
characters that are not valid in an HTTP header, so every request threw while
being built; provider keys are now stripped of BOM/zero-width characters and a
still-invalid key counts as not configured. whisper-1 verbose_json reports the
language by name, which the result contract rejected; names now map to codes.
Fail-closed responses list each provider's failure (status or error class,
no secrets) so an outage can be diagnosed without log access.

server/supabase/functions/_shared/provider-key.test.ts

@@ -0,0 +1,16 @@
+import { sanitizeProviderKey } from './provider-key.ts'
+
+function assert(condition: boolean, message: string): asserts condition {
+  if (!condition) throw new Error(message)
+}
+
+Deno.test('provider keys lose BOMs, zero-width characters and whitespace', () => {
+  assert(sanitizeProviderKey('sk-abc123\r\n') === 'sk-abc123', 'BOM and line ending were kept')
+  assert(sanitizeProviderKey(' sk-abc​123 ') === 'sk-abc123', 'zero-width space was kept')
+  assert(new Headers({ Authorization: `Bearer ${sanitizeProviderKey('sk-x')}` }).has('Authorization'), 'header was not constructible')
+})
+
+Deno.test('a key that is still not printable ASCII counts as not configured', () => {
+  assert(sanitizeProviderKey('키를 여기에') === '', 'non-ASCII placeholder was accepted')
+  assert(sanitizeProviderKey(undefined) === '', 'missing key was not empty')
+})