feat(worker)!: transcribe at an endpoint instead of in the worker's own memory

[TheMeinerLP]

Moves transcription out of the worker's own memory and into an HTTP call against an OpenAI-compatible /audio/transcriptions endpoint. The worker stops owning a model and starts owning a client.

This branch carries three commits: the design document (docs), the implementation (feat(worker)!), and the adoption of OpenSpec (chore) with this change recorded as its first spec under openspec/changes/. The squash merge lands as the feat commit; the other two are the reasoning and the process that produced it.

What it does

The worker no longer loads a CTranslate2 conversion of Whisper and decodes each speaker's track on a thread. It splits a track into windows, uploads each window to the configured endpoint, and assembles the returned segments into the same protocol as before. The image loses CTranslate2 and faster-whisper; the chart loses the model-cache PVC, its volume and mount, and the memory the weights required, so the worker pod is stateless and rolls instead of recreating. /about, the consent prompt and the README now say that plaintext audio leaves the pod, and name the configured host.

Why it is shaped this way

• The engine is removed, not made optional. A backend chosen by environment variable is two live code paths, two test suites and two sets of failure modes for a project with one deployment's worth of operational attention. A self-hoster who wants local computation runs a vLLM or Speaches container and points the base URL at it: a second container, not a second code path, and one somebody else maintains.
• STURNUS_TRANSCRIPTION_BASE_URL has no default, on purpose. It is a consent control. Without it the settings fail to construct and the process does not start, so there is no configuration under which a recording leaves the pod because nobody chose otherwise. The bot needs it as well as the worker, although the bot never calls it: the consent prompt has to name the host before somebody agrees to be recorded, and a bot naming one endpoint while the worker uploads to another would make that prompt a false statement. The chart therefore carries it once, in commonEnv.
• Every window boundary lands inside a silence the speech gate reported. The old engine dropped the gaps and concatenated the speech, then attributed each decoded segment to a clip by Segment.seek, because a decoded end routinely overruns its window; resolving the clip from that end adds the next clip's offset, measured at 20 to 31 seconds of displacement on a 100-minute recording. An HTTP response carries no seek, so the only safe arrangement is one where attribution is unnecessary.
• Two of the three hallucination vetoes move from decoder arguments to rules over the returned segments, as constants carrying their own measurements. avg_logprob is deliberately not a third: an invented subtitle credit is a fluent, high-probability sequence. A response that omits a figure means the rule reading it does not apply, never that the job fails (vLLM omits no_speech_prob; docs/operations.md says which endpoint is the safer one).
• The model registry follows the endpoint. whisper-1 is the only OpenAI model that returns segment timestamps, and a protocol interleaving speakers chronologically cannot be assembled without them. Its entries lose their size and summary, which were honest while the worker downloaded the weights and cannot be written truthfully for a model somebody else serves.
• The stall alert moves with the window cap. Progress now advances once per completed window, so the documented 600 second threshold would page on every healthy multi-window job against the 720 second cap; it is 1800 and documented as a function of that cap.

What it deliberately refuses to do

• No in-process engine, no fallback, no "local" mode behind a flag.
• No default endpoint, and no silent choice of a vendor for the operator.
• The API key reaches no user-facing text, log field, span attribute or metric label. Only the host is ever shown.
• It does not fail a job over a missing optional figure in the response.

Checks

pytest -q 2731 passed · ruff check · ruff format --check · mypy (293 files) · console vitest run 1719 passed (56 files) · vue-tsc --noEmit — all clean.

BREAKING CHANGE: STURNUS_TRANSCRIPTION_BASE_URL is now required by both the bot and the worker and has no default; set it (chart: commonEnv.STURNUS_TRANSCRIPTION_BASE_URL) before upgrading, or neither process starts. The in-process faster-whisper engine is removed; STURNUS_WHISPER_MODEL and STURNUS_MODEL_CACHE_DIR no longer exist, STURNUS_WHISPER_DEFAULT_LANGUAGE is renamed to STURNUS_TRANSCRIPTION_DEFAULT_LANGUAGE, and the chart's worker persistence block and model-cache PVC are removed. STURNUS_TRANSCRIPTION_API_KEY is the new worker secret, and the default model is whisper-1.