feat(desktop): make local speech transcription work end to end

Local dictation had never produced a transcript on an installed build. The
engine itself was healthy; every connection to it was broken.

Installed builds shipped no speech engine at all: the packaging config had no
entry for the faster-whisper sidecar and no pipeline step built one, so the app
always fell back to a system Python without the runtime. Development was broken
too, because the sidecar and SoX paths were resolved against the Vite output
directory instead of the app root, which also meant recording failed with a SoX
ENOENT. On hosts where localhost resolves only to IPv6, every local request was
refused outright, which silently disabled both local transcription and the local
LLM.

The sidecar is now built and bundled (including the Silero VAD data it needs),
gated by a packaging check that fails when the engine or its data is missing.
Paths are discovered from the app root and fail loudly when the engine is
absent. Local engine URLs are normalized to the IPv4 loopback, decoding is tuned
so repeated hallucinations cannot compound (the same transcript now takes about
a fifth of the time), the engine is warmed up at startup, and holding the hotkey
now shows the text forming live in the recording tip.

apps/desktop/electron-builder.yml

@@ -36,6 +36,8 @@ asarUnpack:
   - "node_modules/better-sqlite3/**"
   - "node_modules/uiohook-napi/**"
   - "node_modules/@nut-tree-fork/**"
+  # ffmpeg 정적 바이너리는 실행 파일이므로 asar 내부에서 spawn할 수 없다
+  - "node_modules/@ffmpeg-installer/**"
 
 # ────────────────────────────────────────────────────────────────────
 # Windows
@@ -108,16 +110,29 @@ extraResources:
       - "*.wav"
 
   # SoX 바이너리
+  # 주의: filter에 "**/*"를 쓰면 하위 디렉토리가 통째로 누락된다(실측).
+  # 디렉토리를 그대로 복사할 때는 filter를 지정하지 않는다.
   - from: resources/sox/
     to: sox/
+
+  # faster-whisper STT 사이드카 (PyInstaller onedir: sidecar.exe + _internal/).
+  # 반드시 존재해야 한다. 누락되면 로컬 전사가 전혀 동작하지 않는다.
+  # 빌드: npm --prefix apps/desktop run sidecar:build
+  # electron-builder는 이 트리를 재귀로 복사한다(_internal 포함).
+  # 서명 검증에 실패하면 복사가 중간에 끊겨 _internal이 빠지므로,
+  # 서명 없이 로컬 검증할 때는 -c.win.forceCodeSigning=false 를 사용한다.
+  - from: sidecar-dist/sidecar/
+    to: sidecar/
     filter:
       - "**/*"
 
+  # ffmpeg (파일 전사/미디어 변환용). CI가 resources/ffmpeg/에 배치한다.
+  - from: resources/ffmpeg/
+    to: ffmpeg/
+
   # Ollama 바이너리 (포터블 zip을 사전 배치)
   - from: resources/ollama/
     to: ollama/
-    filter:
-      - "**/*"
 
 nsis:
   # 파일명 공백 금지 — mac.artifactName 주석과 동일한 이유 (latest.yml url 정합)