fix: red-team round 3 hardening across desktop, mobile, core and server

Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.

- desktop main: STT timeouts and sidecar, voice recording store, sync
  (credentials, audio, knowledge reindex, push gates), runtime
  provisioner, update policy, AltGr keybindings, voice-command policy,
  dictionary file codec/limits, meeting transcript condensing and a
  local recording ledger so interrupted-session recovery only closes
  meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
  deletion/retention, durable queue retention, knowledge realtime
  without unfiltered DELETE, meeting re-record failure paths, cloud STT
  client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
  field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
  document generation quota, team RPC null-role guard, unified LLM
  quota in-flight accounting, knowledge chunk vector index, meeting
  re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
  delete and alias planning.

Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.

server/supabase/functions/generate-meeting-document/generation.ts

@@ -6,10 +6,15 @@
 // adapter that wires real clients into these ports and turns the result into a
 // Response.
 //
-// Quota: the claim RPC holds one unit of the user's allowance while the request
-// is 'processing' (migration 20260928000037). Every path that leaves a claimed
-// request unfinished must therefore call markFailed so the unit is released
-// immediately instead of waiting for the lease to expire.
+// Quota: the claim RPC reserves one unit of the user's LLM allowance through
+// the shared reserve_llm_quota lease (migration 20260929020000), the same
+// ledger llm-proxy uses, so a running document and a chat request can never
+// both take the last unit. commit settles the lease; markFailed releases it.
+// Every path that leaves a claimed request unfinished must therefore call
+// markFailed so the unit is returned immediately instead of waiting for the
+// 10 minute lease to expire. commit can still answer generation_quota_exceeded
+// when the lease expired (or the claim predates the lease) and the allowance
+// is spent by then; that maps to markFailed('quota_exceeded') + 429.
 
 import { buildMeetingDocumentSystemPrompt } from '../_shared/generative-ai-safety.ts'
 import {