fix(edge): stop short clips waiting a minute on the NAS and make the OpenAI STT fallback usable

A five-second phone recording took over a minute: stt-proxy waited up to
60 s for the self-hosted gateway, whose GPU endpoint was off and whose NAS CPU
Whisper needs 30-90 s per clip. With a direct provider configured the gateway
now gets 5 s plus the clip length (30 s cap).

The direct OpenAI fallback never produced a result. The production key held
characters that are not valid in an HTTP header, so every request threw while
being built; provider keys are now stripped of BOM/zero-width characters and a
still-invalid key counts as not configured. whisper-1 verbose_json reports the
language by name, which the result contract rejected; names now map to codes.
Fail-closed responses list each provider's failure (status or error class,
no secrets) so an outage can be diagnosed without log access.

server/supabase/functions/embed-chunks/index.ts

@@ -1,6 +1,7 @@
 import { corsHeaders, handleCorsPreflightRequest } from '../_shared/cors.ts'
 import { requireUser, authErrorResponse, type AuthError } from '../_shared/auth.ts'
 import { createServiceRoleClient } from '../_shared/quota.ts'
+import { readProviderKey } from '../_shared/provider-key.ts'
 
 const EMBEDDING_DIMENSIONS = 1536
 const PROVIDER_TIMEOUT_MS = 45_000
@@ -35,7 +36,7 @@ Deno.serve(async (req: Request) => {
       return json(400, { error: 'invalid_document_id' })
     }
 
-    const openaiKey = Deno.env.get('OPENAI_API_KEY') ?? ''
+    const openaiKey = readProviderKey('OPENAI_API_KEY')
     if (!openaiKey) return json(503, { error: 'embedding_provider_unavailable' })
 
     const serviceClient = createServiceRoleClient()