fix(edge): stop short clips waiting a minute on the NAS and make the OpenAI STT fallback usable

A five-second phone recording took over a minute: stt-proxy waited up to
60 s for the self-hosted gateway, whose GPU endpoint was off and whose NAS CPU
Whisper needs 30-90 s per clip. With a direct provider configured the gateway
now gets 5 s plus the clip length (30 s cap).

The direct OpenAI fallback never produced a result. The production key held
characters that are not valid in an HTTP header, so every request threw while
being built; provider keys are now stripped of BOM/zero-width characters and a
still-invalid key counts as not configured. whisper-1 verbose_json reports the
language by name, which the result contract rejected; names now map to codes.
Fail-closed responses list each provider's failure (status or error class,
no secrets) so an outage can be diagnosed without log access.

server/supabase/functions/_shared/stt-contract.test.ts

@@ -2,6 +2,8 @@ import {
   buildDictionaryHints,
   createDeepgramSttUrl,
   createInternalSttGatewayUrl,
+  gatewayDeadlineMs,
+  providerLanguageCode,
   MAX_STT_AUDIO_BYTES,
   normalizeSttResult,
   SttInputError,
@@ -12,6 +14,19 @@ function assert(condition: boolean, message: string): asserts condition {
   if (!condition) throw new Error(message)
 }
 
+Deno.test('provider language names from Whisper verbose_json become codes', () => {
+  assert(providerLanguageCode('korean', 'ko') === 'ko', 'OpenAI/Groq report the language by name')
+  assert(providerLanguageCode('KO', 'en') === 'ko', 'codes pass through lower-cased')
+  assert(providerLanguageCode('klingon', 'ko') === 'ko', 'unknown names fall back to the request')
+  assert(providerLanguageCode(undefined, 'auto') === 'und', 'auto without a report is undetermined')
+})
+
+Deno.test('gateway deadline follows clip length only when a direct provider can take over', () => {
+  assert(gatewayDeadlineMs(96_000, true) === 8_000, '3 s clip should wait 5 s + 3 s')
+  assert(gatewayDeadlineMs(32_000 * 600, true) === 30_000, 'long clips are capped at 30 s')
+  assert(gatewayDeadlineMs(96_000, false) === 60_000, 'without a fallback the gateway keeps the full timeout')
+})
+
 Deno.test('STT input contract accepts real supported audio and preserves its type', () => {
   const audio = new Blob([new Uint8Array([1, 2, 3])], { type: 'audio/mp4' })
   const result = validateSttAudio(audio, 'ko')