Add universe model defaults, transcription, and session tooling

[lukebuehler]

Universe model selection now lives in runtime-owned defaults, and audio transcription runs as an independent workflow. The web composer can record dictation into an editable draft, attach files, and select a model; session resources and stored blobs are easier to inspect. This branch also adds immediate API-key secret rotation.

Changes

• Add revisioned agentRun and speechToText defaults with public API, CLI, Platform settings, provider validation, and local-development seeding. Explicit and profile models take precedence; existing sessions retain their selected model.
• Move transcription out of session admission into a standalone workflow with start/read/cancel operations. Prepare channel voice messages before bot delivery, preserve audio/transcript provenance, and support configured provider endpoints.
• Add browser dictation, composer attachments and model selection, session resource summaries, workspace navigation improvements, and a blob viewer with source-session links. Dictation edits the draft and never sends automatically.
• Add immediate API-key rotation through the API, both CLIs, and both key-management pages. Replace the secret and prefix atomically while preserving authority, show the new secret once, and audit the rotation. Classify root-admin password login as an emergency sign-in only when SSO is enabled.
• Regenerate API/workflow contracts and consumers, update documentation, and include the proposed external-harness design (documentation only).

Upgrade notes

• Adds runtime migration 010_model_defaults.sql and advances the required schema revision from 9 to 10. Apply migrations before starting the updated runtime.
• LIGHTSPEED_CHAT_PROVIDER and LIGHTSPEED_CHAT_MODEL are retired and rejected at startup. Configure universe defaults instead. Requests that need an unset default return model_default_unset.
• Key rotation has no grace period: update consumers with the replacement secret immediately. Rotation itself requires no schema change.

Validation

• npm run check passed: launcher checks, generated artifacts, TypeScript checks, consumer tests, and production/demo builds. Non-failing frontend warnings remain.
• cargo clippy passed; its sole warning was fixed, then cargo clippy -p temporal-server -- -D warnings passed.
• cargo test -p api passed, including committed schema freshness.
• Isolated PostgreSQL API-key tests passed, including immediate invalidation, metadata preservation, revoked-key refusal, and concurrent rotation.
• npm run check:docs and scripts/release/verify-metadata.sh passed.