fix(edge): stop short clips waiting a minute on the NAS and make the OpenAI STT fallback usable

A five-second phone recording took over a minute: stt-proxy waited up to
60 s for the self-hosted gateway, whose GPU endpoint was off and whose NAS CPU
Whisper needs 30-90 s per clip. With a direct provider configured the gateway
now gets 5 s plus the clip length (30 s cap).

The direct OpenAI fallback never produced a result. The production key held
characters that are not valid in an HTTP header, so every request threw while
being built; provider keys are now stripped of BOM/zero-width characters and a
still-invalid key counts as not configured. whisper-1 verbose_json reports the
language by name, which the result contract rejected; names now map to codes.
Fail-closed responses list each provider's failure (status or error class,
no secrets) so an outage can be diagnosed without log access.

server/supabase/functions/_shared/provider-key.ts

@@ -0,0 +1,22 @@
+// Provider API keys read from function secrets.
+//
+// A secret pasted from a Windows file or a rich-text source can carry a BOM,
+// zero-width characters or surrounding whitespace. Such a value is not a valid
+// HTTP header ByteString, so every request built with it throws before leaving
+// the function — the OpenAI STT fallback failed this way on every call until
+// 2026-09-27 ("headers of RequestInit is not a valid ByteString"). Strip the
+// invisible characters; anything still outside printable ASCII is treated as
+// not configured, so the provider is skipped instead of failing each request.
+
+const INVISIBLE = /[​-‍⁠ \s]/g
+const PRINTABLE_ASCII = /^[\x21-\x7E]+$/
+
+export function sanitizeProviderKey(raw: string | undefined | null): string {
+  if (!raw) return ''
+  const value = raw.replace(INVISIBLE, '')
+  return PRINTABLE_ASCII.test(value) ? value : ''
+}
+
+export function readProviderKey(name: string): string {
+  return sanitizeProviderKey(Deno.env.get(name))
+}