Feature/remote whisper provider

[GermaniU]

Description

Adds a third transcription provider, remoteWhisper, that sends audio to a
self-hosted OpenAI-compatible server (POST /v1/audio/transcriptions) instead of
loading a model in-process. Audio still never leaves infrastructure the user
controls — it just runs on a machine with a stronger GPU.

Three pieces, one per commit:

1. The provider — talks to the server, stores the URL in the existing model
   column of transcript_settings (no schema change), needs no API key.
2. Onboarding — a collapsed "Already running your own AI servers?" disclosure
   lets you pick the remote backend, or defer the summary model, without
   downloading ~670 MB you will never use. The default path is unchanged.
3. The recording gate — useRecordingStart.ts checked for a local Parakeet
   model regardless of the configured provider, which made the feature unusable.

They ship together because 1 without 3 is a dead end: the gate blocks every
recording attempt and offers a download dialog that has no option for a remote
server.

Notes for reviewers

• Language sentinels. The picker emits auto / auto-translate, which are not
  ISO-639-1 codes; forwarding them makes faster-whisper answer 500. They are
  dropped, which is exactly how that API is asked to auto-detect.
• auto-translate is hidden for this provider. /v1/audio/transcriptions
  transcribes in the source language — translation lives behind
  /v1/audio/translations. Rather than return untranslated text as if it had been
  translated, the option is hidden and the stored preference is coerced on its way
  to the backend, so switching back to Local Whisper restores the user's choice.
• /health proves reachability, not readiness. The green check in onboarding
  means the server answered; it cannot promise the next transcription succeeds.
  Observed in practice: a server returning 200 {"status":"ok"} while inference
  was broken.
• complete_onboarding signature changed (model: String → Option<String>);
  None means the user brings their own summary provider. ModelStatus gains two
  optional fields; both use serde defaults, so statuses written by earlier versions
  still load — covered by tests.

Related Issue

Fixes #637
Implements #612, #301, #225, #527

Type of Change

• Bug fix
• New feature
• Documentation update
• Performance improvement
• Code refactoring
• Other

Testing

• Unit tests added/updated
• Manual testing performed
• All tests pass

7 unit tests: language sentinel handling, WAV header shape, and onboarding status
backward compatibility. Manually tested on macOS (Apple Silicon) against a
faster-whisper server running large-v3-turbo on an RTX 3060 — onboarding with
the remote backend, recording, and live transcription over several sessions.

Documentation

• Documentation updated
• No documentation needed

Checklist

• Code follows project style
• Self-reviewed the code
• Added comments for complex code
• Updated README if needed
• Branch is up to date with devtest
• No merge conflicts

Screenshots

Additional Notes

The recording-gate fix (#637) affects users who never touch remote transcription:
it also unblocks anyone using Local Whisper, which is what that issue reports.

[GermaniU]

Peer review — Remote Whisper provider

Solid work. The four commits are cleanly separated, the messages explain the why rather than the what, and the change fits the existing abstractions (TranscriptionProvider trait, reuse of the model column, serde-defaulted status fields with round-trip tests). Nothing here breaks the existing local flow.

One issue I'd fix before merge, plus a few non-blocking follow-ups. Details inline.

🔴 Health check couples to a contract the provider doesn't promise

is_model_loaded() probes GET /health, but transcription uses POST /v1/audio/transcriptions. /health is not part of the OpenAI /v1/audio/transcriptions convention — it's specific to whisper.cpp-server / faster-whisper-server. A server that correctly implements /v1/audio/transcriptions but doesn't expose /health (OpenAI's own API, a minimal proxy, a custom gateway) fails onboarding validation and the recording gate even though it transcribes fine — and since Continue is gated on the probe passing, that user is stuck in the wizard with no obvious way out. Prefer GET /v1/models (part of the OpenAI contract), or fall back to it on 404, or at minimum document that the server MUST expose /health.

🟡 Warnings

• encode_wav_pcm16: data_size/riff_size are u32 with unchecked arithmetic — silent wrap on absurdly long buffers in release. Theoretical for second-long chunks; a debug_assert!/saturating_add documents the invariant for free.
• No retry on a transient network blip: the local path couldn't lose a chunk this way; the remote one drops the whole POST on a momentary LAN hiccup. One short-backoff retry would avoid gaps in live transcripts. Robustness regression vs local, not a blocker.
• REQUEST_TIMEOUT_SECS = 60 is fixed and not configurable — a large chunk on a busy server is cut and lost.

🟢 Well done

Language coercion lives in ConfigContext (not the settings panel) so provider switches without opening the modal stay consistent; the user's real preference is preserved and restored; the double-write in handleSetSelectedLanguage was removed to avoid the race; serde backward-compat is covered by two tests; hasLoadedStatusRef guards the debounced save and is released in finally; the three call sites are unified so they can't drift.

No HTTP-path test for transcribe() (would need a mock server) — acceptable, but a wiremock/httpmock fake would close the gap on the multipart + {"text": ...} parsing.

Reviewed by Hermes (agent) — model: claude-opus-4-8 (Anthropic), via the Hermes gateway — on Germani's behalf.