feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6

[kh0pper]

What this adds (kiosk 0.3.6)

"Play " on a paired display plays the stream through the page's own <audio> element with no model call. "Pause", "keep playing", "louder", "what's playing" and "stop" act at once with no model. A question asked over music ducks it (or, on a phone or tablet, pauses it) and brings it back. The display never receives an upstream URL or a credential.

Merge only inside a deploy window. This PR must not be merged outside an attended deploy window for the kiosk (it also moves stored volume caps once at boot; see "Volume").

• Display tickets (server/tickets.js): one stream for one display under /display/t/<id>/stream, behind the display network gate (not a Funnel prefix). A ticket is bound to one device and one resource. At most 8 per device and 2 concurrent requests. Tickets last 12 h, and a timer aborts open requests at expiry. GET only, no-store, never logged.
• Stream relay (server/relay.js, server/netscope.js): each upstream carries a hop policy. On every hop the name is resolved once, every resolved address is checked, and the connection goes to the address that was checked (pinned through the request's lookup). A credential is sent on the first hop only, and https→http is refused when a credential was sent. At most 3 redirects. 10 s to headers, 30 s body idle. Only audio content types pass, and only one Range is passed through.
• Media session (server/media.js, session.js): queue, state, volume with a per-display cap. A station that drops after it has played is reloaded up to three times. Every hello carries the media state, and every turn_start gets exactly one closing frame (turn_done or turn_over). Two optional device settings, max_volume and pause_media_on_listen; no default ever writes them.
• Sources and stations (server/sources/): a source contract (contract 1) and its first adapter, operator-entered station presets with one canonical spoken form. The repo ships no presets.
• Play and transport verbs (play.js, executor.js, patterns.js, phrases.js, strings.js en/es): a confident station match plays at T1. "Which one?" is remembered for 30 s. The model's next is the playback verb, and "close everything" also stops audio.
• Runtime and admin (runtime.js): station admin routes behind the dashboard session and CSRF. One invalid row refuses the whole save. Unpairing a display, or the end of the login behind a session display, ends its stream and revokes its tickets. When the instance has a station, the turn check adds a fourth sentence, which must start playback with no model.
• Panel: a station editor with a per-row Home network tick, plus loudest volume and pause-while-listening per display.
• Page: one <audio> element and a now-playing chip. Ducking follows the mic, the bird and the speech, with a 30 s backstop. A watchdog catches streams that never start or that stall. A blocked autoplay waits for a tap. New nowplaying window.
• Docs en/es; kiosk 0.3.6. No funkwhale change in this PR.

Core changes (voice turn) — this PR is not kiosk-only

servers/gateway/voice/turn.js, servers/gateway/voice/turn-helpers.js, servers/gateway/ai/stt/adapters/fasterwhisper.js:

• Optional STT hints. opts.sttPrompt (the OpenAI-style prompt, ≤ 200 characters) and opts.sttHotwords (faster-whisper's hotwords, ≤ 6 words), each a string or a function of the STT profile; the faster-whisper adapter sends both fields. Callers that pass neither are unchanged. The kiosk sends no prompt (a station-name prompt made the speech model spell letters, repeat itself and mishear short commands), and its hotwords are a switch that is OFF by default (CROW_KIOSK_STT_HOTWORDS=1), used only when both the display and the STT profile are English, from the operator's own all-capitals call signs.
• Repetition-loop guard. A transcript that is an STT repetition loop (the same word 8 times running; 6 times when that run is most of a line of 40+ characters; a 1–3 character unit 12 times inside a non-numeric word) ends the turn as an empty transcript, before any fast path or model. Ordinary repeated speech ("no, no, no", "sí, sí", laughter, a title, long numbers) is kept.
• Tool-syntax guard. Tool-call syntax a model writes as text (Qwen/Hermes XML tags, [TOOL_CALLS], <|python_tag|>, <function_call>, a bare or pretty-printed JSON call, a fenced json block; any case; split across deltas) is never captioned, spoken or kept in the history. Plain prose that quotes a {"name": …} object is cut too (accepted for speech).
• Both guards apply to every caller of runVoiceTurn: the kiosk AND the glasses endpoint. The companion runs its own loop and is not covered.
• Counts-only timings: verb (a fixed word on a no-model turn), stt_degenerate, tool_text, spoken_chars, stt_hotwords (true/false; never the words). Never transcript text.

Changed since the last push (third attended smoke and its review)

• Pause while paused. With the music already paused, every pause-family request ("Pause.", "Paws.", "Pause it.", "Pause the music.", "Pause. Thank you.") is answered with no model, quietly, and the paused item is sent to the page again; it never resumes.
• The sentence's own command wins. When a sentence reads as one playback command with no model ("Pause.", "Louder."), a different playback verb chosen by the model never runs; the sentence's verb runs instead. Turn metrics name the verb the model asked for (model_verbs) and the one that ran instead (model_verbs_kept), as fixed words.
• Volume. 0–100 now spans −50…0 dB on the element (0 is mute). Each "louder"/"quieter" (or window button) moves 10 dB; "quieter" stops at a quiet but audible floor (10, −45 dB), and only "volume zero" or "mute" silences. A spoken level is that point on the scale ("volume 50" ≈ −25 dB). A new session starts at 80 (−10 dB). Stored "Loudest volume" caps move once at boot to the level that is as loud or quieter (linear 100→100, 90–60→90, 50/40→80, 30/20→70, 10→60), and are marked so the move never repeats; the move is lossy, so a rollback must restore the stored device list from a backup taken before the deploy.
• Speech-to-text forms of short commands ("Louders.", "Quiter.", "Pons.", a trailing "thank you"/"thanks") act like the words, only as the whole utterance and only while something plays.
• STT hotwords stay off by default (the switch remains for operators).
• Wired tests destroy their server's open sockets on close, so a failing test ends the run instead of hanging it.

Earlier fixes (second attended smoke and two reviews)

• A spoken reply always settles. The page's player ends a reply whose audio never finishes (only once its audio clock has stopped moving; a late Bluetooth sink is never cut; capped at twice its length + 5 s) and drops a decode that never answers. On a phone the mic is let go only once the turn is done and nothing plays (never between two sentences, and before the music comes back), so the call/media audio-mode switch no longer lands in the reply. Turn metrics add tts_stalled, tts_audio_ms, stall_ctx_state, stall_clock_moved, ctx_state.
• Station names by voice. No STT prompt (above). A call sign one sound off ("Play BTPF" for KTPF-style names) is asked about ("Did you mean …?") with no model, never played. With radio presets, a station asked for in words the STT mangled still offers the play tool (never forces it); interjections without a vowel do not count.
• Pause / Play. The single words "Pause." / "Play." with something loaded are answered with no model, and the whole current item is sent to the page again, so a page that shows another state, another item or none is put right. "Play." with nothing loaded answers "Nothing is paused. What would you like to hear?" (es too); while a choice is pending it answers it instead (one suggestion: plays it; several: asks again by name). Turn metrics carry the server's media state before/after (media_before, media_after) and the page's own (page_media_start, page_media_end).
• "Already playing" re-sends the current item, so it is true where it is heard.

Known gaps

• Some playback requests still go to the model unforced, so a claim is still possible: "Pause the music, I have a call", "The kids are too loud, turn it up" (a statement), "No, louder" (a negation). In "Play jazz and turn it up" only the first must-run tool is enforced.
• iPhones keep the open mic (pause-while-listening still applies) until an iPhone is checked. On Android the spoken answer plays while the phone is still in call audio mode (the mic is released after it).
• The cause of the replies that did not settle on a phone is an inference (an Android audio-mode switch stalling the page's audio clock); the metrics are there to confirm or refute it.
• The loop guard does not catch phrase loops ("Thank you. Thank you. …") and still drops an 8× repeated word. A short reply on a sink that wakes later than its length + 2 s is cut.
• The whisper.cpp STT adapter sends neither field.
• The human-voice rates on a real phone are measured in the attended smoke, not here.

Home-network ("local stream") station policy

A station may point at a stream on the home network or the tailnet only when the operator ticks Home network for that row. The tick is off by default and can be set only through the admin route (dashboard session + CSRF). The model never supplies a URL.

On every hop of every station, ticked or not: an address of this host itself is refused (own_address); any address inside the on-link prefix of any interface of this host is refused (private_address), with the interface table and default-route interfaces read again on every hop (fail closed); address classes come from the shared classifier (servers/shared/ip-classify.js), and the relay additionally refuses an IPv4 embedded in a SIIT, IPv4-compatible, NAT64, 6to4 or Teredo form even when it is public.

For a ticked station the entered host:port may resolve only to an address inside a prefix of the default-route interface (RFC 1918, CGNAT, ULA, or that LAN's own global IPv6 prefix; never the network or broadcast address) or the tailnet ranges (100.64.0.0/10, fd7a:115c:a1e0::/48) when not inside another interface's prefix. Refused even with the tick: other interfaces' prefixes, an RFC 1918 address on no interface, loopback, link-local (metadata included), multicast, broadcast, reserved, embedded or translated IPv4, IPv6 site-local, this host, and any public answer for a ticked host. Pinning: the server resolves the ticked host once at save, judges every address and stores the set; every play and same-host redirect must resolve inside it (address_changed otherwise). Redirects from a ticked station may go only to the same host:port (http→https allowed) or to a public address under the public rule; no credential is ever sent on this policy.

The relay's public rule also refuses any address the shared classifier counts as one of this host's networks (isOwnNetworkIp), at netscope.js judgeAddress, on the public rule only; a guard test keeps the production predicate address-only (kiosk-relay).

How this meets the display tools on main

• The screen guard no longer counts the model's next as a window verb (here it is only the playback verb). The guard's parity test still passes for every window verb.
• The panel keeps the Theme setting alongside loudest volume and pause-while-listening. The turn check keeps the voice selection and adds the play sentence. The finished-timer behaviour from fix(kiosk): a finished timer stays in its pane and goes with one tap; its close button is clear of the dashboard's; kiosk 0.2.2 #453 is kept.

Tests

• On current main (54e682d5). Full suite on this head, scratch env: 7,918 tests, 7,917 pass, 0 fail, 1 skipped.
• build-registry --check OK, check-public-hygiene clean.

Not run here: anything on a live host (evaluation, attended smoke, deploy window). Those happen separately before merge.