fix: red-team round 3 hardening across desktop, mobile, core and server

Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.

- desktop main: STT timeouts and sidecar, voice recording store, sync
  (credentials, audio, knowledge reindex, push gates), runtime
  provisioner, update policy, AltGr keybindings, voice-command policy,
  dictionary file codec/limits, meeting transcript condensing and a
  local recording ledger so interrupted-session recovery only closes
  meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
  deletion/retention, durable queue retention, knowledge realtime
  without unfiltered DELETE, meeting re-record failure paths, cloud STT
  client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
  field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
  document generation quota, team RPC null-role guard, unified LLM
  quota in-flight accounting, knowledge chunk vector index, meeting
  re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
  delete and alias planning.

Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.

scripts/ci/publish-portable-release.mjs

@@ -9,12 +9,16 @@
 //   .../generic/d3ro-voice/portable-<version>/<륨>.7z.00N
 //   .../generic/d3ro-voice/portable-<version>/portable.json
 //   .../generic/d3ro-voice/portable-<version>/install-d3ro-voice.ps1
-//   .../generic/d3ro-voice/portable-latest/...           (동일 파일 alias)
+//   .../generic/d3ro-voice/portable-latest/...           (zip 부품 + install-d3ro-voice.ps1 + portable.json)
 //   .../generic/d3ro-voice/runtime-<version>/...         (로컬 AI 런타임 부품 + runtime.json)
-//   .../generic/d3ro-voice/runtime-latest/...            (동일 파일 alias)
+//   .../generic/d3ro-voice/runtime-latest/runtime.json   (인덱스만 — 부품 URL은 runtime-<version>)
 //
 // 버전 경로는 불변(다른 바이트면 중단, 부분 업로드는 이어 올림), *-latest 별칭은 버전 경로가
 // 모두 완성된 뒤 더 오래된 버전으로 되돌리지 않을 때만 교체한다 — lib/portable-publish-policy.mjs.
+// 별칭에는 클라이언트가 별칭 경로로 직접 받는 파일만 둔다(aliasNames). 7z 볼륨·런타임 부품은
+// 인덱스가 버전 경로 URL로 가리키므로 별칭에 올리지 않는다. 설치 스크립트는 zip 부품을
+// `$FeedBase/<부품>`(= portable-latest)에서 받으므로 zip 부품은 별칭에 둔다.
+// 별칭 교체는 파일 단위 DELETE→PUT이고 인덱스가 마지막이다(패키지째 지우지 않는다).
 //
 // 사용:
 //   node scripts/ci/build-portable.mjs
@@ -26,6 +30,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { withFileDeletion } from './lib/forgejo-generic-file-delete.mjs'
 import { createForgejoGenericRegistry } from './lib/forgejo-generic-registry.mjs'
 import { publishPortablePackages } from './lib/portable-publish-policy.mjs'
 
@@ -56,7 +61,10 @@ if (!existsSync(installerPath)) {
 }
 
 // 게시 전 해시 재검증 — 파일이 바뀌었는데 인덱스가 낡으면 불일치 배포가 된다.
+// 순서: 볼륨 → zip 부품 → 설치 스크립트 → portable.json(인덱스가 마지막 = 커밋 지점)
 const payloads = []
+/** portable-latest 별칭에 둘 파일 (설치 스크립트가 별칭 경로에서 직접 받는 것) */
+const portableAliasNames = []
 for (const volume of index.volumes) {
   const path = join(releaseDir, volume.name)
   if (!existsSync(path)) {
@@ -88,17 +96,19 @@ for (const part of index.zipParts ?? []) {
     process.exit(1)
   }
   payloads.push({ name: part.name, bytes: partBytes, contentType: 'application/octet-stream' })
+  portableAliasNames.push(part.name)
 }
-payloads.push({
-  name: 'portable.json',
-  bytes: Buffer.from(`${JSON.stringify(index, null, 2)}\n`, 'utf8'),
-  contentType: 'application/json',
-})
 payloads.push({
   name: 'install-d3ro-voice.ps1',
   bytes: await readFile(installerPath),
   contentType: 'text/plain',
 })
+payloads.push({
+  name: 'portable.json',
+  bytes: Buffer.from(`${JSON.stringify(index, null, 2)}\n`, 'utf8'),
+  contentType: 'application/json',
+})
+portableAliasNames.push('install-d3ro-voice.ps1', 'portable.json')
 
 // ── 로컬 AI 런타임 번들 게시 (설치본에는 없고, 앱이 처음 필요할 때 내려받는다) ──
 const runtimeDir = join(releaseDir, 'runtime')
@@ -141,12 +151,16 @@ async function forgejoFetch(url, init = {}) {
 
 const PACKAGE_API = 'https://git.chanpaca.net/api/v1/packages/yunchan/generic/d3ro-voice'
 
-const registry = createForgejoGenericRegistry({
-  feedUrl: FEED,
-  packageApiUrl: PACKAGE_API,
-  fetchImpl: forgejoFetch,
-  onUploaded: (url) => console.log(`[portable] uploaded ${url}`),
-})
+// 파일 단위 삭제를 더해 별칭을 패키지째 지우지 않고 바뀐 파일만 교체한다.
+const registry = withFileDeletion(
+  createForgejoGenericRegistry({
+    feedUrl: FEED,
+    packageApiUrl: PACKAGE_API,
+    fetchImpl: forgejoFetch,
+    onUploaded: (url) => console.log(`[portable] uploaded ${url}`),
+  }),
+  { fetchImpl: forgejoFetch },
+)
 
 // 정책(불변 버전 경로 · 별칭 롤백 방지)은 lib/portable-publish-policy.mjs 에 있다.
 // 버전 경로(runtime-<v>, portable-<v>)를 모두 완성한 뒤에만 *-latest 별칭을 갱신한다.
@@ -154,8 +168,14 @@ try {
   await publishPortablePackages({
     version,
     packages: [
-      { kind: 'runtime', indexName: 'runtime.json', payloads: runtimePayloads },
-      { kind: 'portable', indexName: 'portable.json', payloads },
+      // 런타임 부품은 runtime.json이 runtime-<version> URL로 가리킨다 → 별칭에는 인덱스만.
+      {
+        kind: 'runtime',
+        indexName: 'runtime.json',
+        payloads: runtimePayloads,
+        aliasNames: ['runtime.json'],
+      },
+      { kind: 'portable', indexName: 'portable.json', payloads, aliasNames: portableAliasNames },
     ],
     registry,
     dryRun: check,
@@ -175,7 +195,7 @@ console.log(
     `  인덱스 : ${FEED}/portable-latest/portable.json`,
     `  스크립트: ${FEED}/portable-latest/install-d3ro-voice.ps1`,
     runtimePayloads.length
-      ? `  런타임 : ${FEED}/runtime-latest/runtime.json (${runtimePayloads.length}개 파일)`
+      ? `  런타임 : ${FEED}/runtime-latest/runtime.json (runtime-${version} 에 ${runtimePayloads.length}개 파일)`
       : '  런타임 : (없음)',
     '',
     '  설치(Scoop, 권장):',