feat(kiosk): the music library and the news briefing on a display, the library's own tools through the envelope; funkwhale 1.0.6; kiosk 0.3.7

[kh0pper]

Stacked on #443. The base is #443's branch, so this diff holds only the library and news work (and the evaluation's held-out set). Do not merge it in this form, and do not merge it outside a deploy window. Once #443 is squash-merged, this branch gets rebased onto main and the PR is retargeted.

Versions: kiosk 0.3.7, funkwhale 1.0.6. The core voice-turn changes (optional STT prompt/hotwords, the repetition-loop and tool-syntax guards, which also cover the glasses endpoint; the kiosk's hotwords switch is off by default) and the playback changes (the −50…0 dB volume range with 10 dB per request, pause requests while paused answered with no model, the sentence's own command winning over the model's) come from #443; this PR adds no core change of its own.

What a user can say

• "Play some jazz", "play ", "play " or "play " plays from the Funkwhale library on the display, with no model call when the match is confident. When the request is ambiguous, the display asks "Which one?" and remembers the choices for 30 seconds.
• "Play the news" plays the newest spoken briefing that has audio, as long as it is at most seven days old. If no such briefing exists, the display says there is no recent one. It never plays an old briefing as today's news.
• The transport verbs from feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6 #443 (pause, keep playing, louder, what's playing, stop, next) work the same way for library and news audio.
• When an assistant uses the library's own play tools (fw_play, fw_play_album), the result can join the display's media session. Only those two tools are accepted, and only for the server's listen path. The stream is rebuilt on the server and never fetched from the address in the tool result.

Changed since the last push

• Rebased onto the updated feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6 #443 (kiosk 0.3.6: the fixes from the third attended smoke and its review); this branch is now kiosk 0.3.7.
• Spoken album numbers. A number range is read and matched as "N to M" ("1970-2002" said "nineteen seventy to two thousand two"), with "to" between two numbers folding away on both sides; the match report reads a long title whole instead of its 80-character display form. Written matches are unchanged.
• The evaluation's held-out set commit is kept (a new held-out half; the previous set kept verbatim and refused as spent).

Earlier changes

• Spoken library names. A name spelled letter by letter keeps an "n" or an "r b" inside it, while "r n b" after an article is still the genre; a thousands separator joins its digits; larger numbers and leading zeros are read as people say them. The match report's spoken rate is an agreement between the report's own reader and the matcher, not an STT rate.

How audio reaches the display

The display gets only a short-lived ticket path on this gateway. It never receives an upstream URL or a credential. The relay from #443 serves every stream:

• Library streams use the relay's service policy. The first hop goes to the operator-entered library address, carries the add-on's token and is limited to the listen path. Exactly one redirect is allowed, and it must go to the operator-entered storage address. The token is never sent past the first hop.
• News is a stored file. The only file served is a regular .mp3 whose real path, with links followed, is inside the data directory's media/audio/. That check runs again on every request. One byte range per request; other methods get 405 and a bad range gets 416.

What the relay refuses

• Other library paths, a second redirect, a redirect to any other origin, and metadata endpoints.
• Any address this host considers its own or on-link, as in feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6 #443.
• A news row that points outside the audio directory, at a link that leads out of it, or at anything that is not an .mp3.

Settings

• The library is offered only when three things are present: the Funkwhale add-on with its access token, plus a library address and a storage address, both entered by the operator in Kiosk → Music library. Neither address is guessed or defaulted. Check compares the storage address with the server's real redirect. While the library's names are being read, the panel's status line updates by itself.
• The library is read-only from the display. Nothing is written to it.
• The per-display settings from feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6 #443 (loudest volume, pause while listening) apply to library and news audio as well. This PR adds no new per-display setting.

Funkwhale tool fixes (1.0.6)

• A track found by search plays by its integer id: one lookup, no list scan.
• A file is copied only when its extension needs it.
• An album plays in disc order across pages.
• The blocklist import, which was never implemented, is no longer listed.

Known gaps

• Library names are not sent to speech-to-text (thousands of names do not fit); the library relies on the spoken-form matcher. "One eight hundred" for a "1-800-…" name and "twenty four seven" for "24/7" still miss.
• The match rate against a real library and the latency budgets are measured in the attended smoke, not here.
• The known gaps listed on feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6 #443 apply here too.

Scope

No schema change, no new port, no new package, no container.

Checks

• Rebased onto current main (54e682d5) via feat(kiosk): audio on a display: radio stations (incl. operator-ticked home-network streams) through a pinned stream relay, display tickets, transport verbs, ducking, now playing; voice turn: optional STT prompt/hotwords, repetition-loop and tool-syntax guards; kiosk 0.3.6 #443. Full suite on this head, scratch env: 7,985 tests, 7,984 pass, 0 fail, 1 skipped.
• build-registry --check OK, check-public-hygiene clean.