fix(edge): stop short clips waiting a minute on the NAS and make the OpenAI STT fallback usable

A five-second phone recording took over a minute: stt-proxy waited up to
60 s for the self-hosted gateway, whose GPU endpoint was off and whose NAS CPU
Whisper needs 30-90 s per clip. With a direct provider configured the gateway
now gets 5 s plus the clip length (30 s cap).

The direct OpenAI fallback never produced a result. The production key held
characters that are not valid in an HTTP header, so every request threw while
being built; provider keys are now stripped of BOM/zero-width characters and a
still-invalid key counts as not configured. whisper-1 verbose_json reports the
language by name, which the result contract rejected; names now map to codes.
Fail-closed responses list each provider's failure (status or error class,
no secrets) so an outage can be diagnosed without log access.

server/supabase/functions/search-knowledge/index.ts

@@ -2,6 +2,7 @@
 import { createClient } from 'https://esm.sh/@supabase/supabase-js@2.39.7'
 import { corsHeaders, handleCorsPreflightRequest } from '../_shared/cors.ts'
 import { requireUser, authErrorResponse, type AuthError } from '../_shared/auth.ts'
+import { readProviderKey } from '../_shared/provider-key.ts'
 
 const EMBEDDING_DIMENSIONS = 1536
 const PROVIDER_TIMEOUT_MS = 45_000
@@ -37,7 +38,7 @@ Deno.serve(async (req: Request) => {
       return json(400, { error: 'invalid_count' })
     }
 
-    const openaiKey = Deno.env.get('OPENAI_API_KEY') ?? ''
+    const openaiKey = readProviderKey('OPENAI_API_KEY')
     if (!openaiKey) return json(503, { error: 'embedding_provider_unavailable' })
 
     let embeddingResponse: Response