fix: red-team round 3 hardening across desktop, mobile, core and server

Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.

- desktop main: STT timeouts and sidecar, voice recording store, sync
  (credentials, audio, knowledge reindex, push gates), runtime
  provisioner, update policy, AltGr keybindings, voice-command policy,
  dictionary file codec/limits, meeting transcript condensing and a
  local recording ledger so interrupted-session recovery only closes
  meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
  deletion/retention, durable queue retention, knowledge realtime
  without unfiltered DELETE, meeting re-record failure paths, cloud STT
  client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
  field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
  document generation quota, team RPC null-role guard, unified LLM
  quota in-flight accounting, knowledge chunk vector index, meeting
  re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
  delete and alias planning.

Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.

apps/desktop/tests/main/services/meeting-condense-redteam-r3-3.test.ts

@@ -0,0 +1,28 @@
+// tests/main/services/meeting-condense-redteam-r3-3.test.ts
+// 줄바꿈 없는 긴 전사(자막·파일 전사 히스토리, 폰 회의)도 map 조각이 프록시 한도 안에 들어가야 한다.
+import { describe, expect, it, vi } from 'vitest'
+import { condenseTranscriptToBudget } from '../../../src/main/services/meeting/transcript-condenser'
+
+const PROXY_MESSAGE_LIMIT = 8_000
+
+/** CaptionService fullText 처럼 세그먼트를 공백으로 이어 붙인 한 줄 전사 */
+const singleLine = Array.from({ length: 900 }, (_, i) => `${i}번째 발언에서 일정과 담당자를 정리했습니다.`).join(' ')
+
+describe('condenseTranscriptToBudget — 한 줄짜리 긴 전사', () => {
+  it('한 줄 20,000자 전사를 여러 조각으로 나눠 줄이고, 조각 입력은 모두 한도 안이다', async () => {
+    expect(singleLine.includes('\n')).toBe(false)
+    expect(singleLine.length).toBeGreaterThan(20_000)
+    const inputs: string[] = []
+    const llm = {
+      generate: vi.fn(async (text: string) => {
+        inputs.push(text)
+        return { text: `요약 ${inputs.length}` }
+      }),
+    }
+    const result = await condenseTranscriptToBudget(llm, singleLine, PROXY_MESSAGE_LIMIT)
+    expect(result.condensed).toBe(true)
+    expect(result.text.length).toBeLessThanOrEqual(PROXY_MESSAGE_LIMIT)
+    expect(inputs.length).toBeGreaterThan(1)
+    for (const input of inputs) expect(input.length).toBeLessThanOrEqual(PROXY_MESSAGE_LIMIT)
+  })
+})