(CODUX-182) Allow audio-only capture in Electron permission checks

[numnx]

🧩 Task: Allow audio-only capture in Electron permission checks

Automated task PR opened by Code UX for T10.

📋 Summary

Sprint: Sprint 182 · Speech Input and Memory Browser · Task: T10

Add speech-to-text input across the dashboard chat thread composer with local ONNX transcription and external API fallback, package it safely for Electron/npm runtimes, and modernize the Memory page model browser with grouped embedding/TTS models plus custom Hugging Face model links.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-07 14:39:33 UTC
Finished	2026-07-07 14:46:29 UTC
Duration	6m 55s

📊 Token Usage

Metric	Value
Input tokens	197,516
Cached input tokens	1,109,120
Output tokens	8,784
Total tokens	1,315,420
Invocations	1
Tool calls	38
Active time	5m 55s

Included usage estimate (subscription/local login): $1.81

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Make Electron's microphone/media permission checks honor the media-type details exposed by the permission check API so trusted dashboard audio capture is allowed consistently.

## Scope
- Edit `src/electron/main.ts`
- Edit `src/electron/dashboard-network-policy.ts` if the helper needs to accept permission-check details
- Edit or add tests under `tests/backend/electron/`

## Implementation Requirements
1. Use the media-type details available to `setPermissionCheckHandler` when deciding `media` permissions, not just the requesting origin string.
2. Allow audio-only capture from the trusted dashboard origin and continue to reject video/camera requests and unrelated origins.
3. Keep the existing permission request behavior for microphone/media and the current denial rules for all other permissions.
4. Add tests proving the check handler and request handler both permit audio-only capture and deny preview or untrusted origins.

## Constraints
- Do not weaken origin trust checks, cross-site protections, or non-media permission denial.
- Do not grant camera, geolocation, notifications, or arbitrary Electron permissions.

## Verification
- Run `pnpm exec vitest run tests/backend/electron/dashboard-network-policy.test.ts`
- Run `pnpm run build`

🌿 Branch Info

Base: feature/CODUX-182-speech-input-and-memory-browser
Head: task/feature-codux-182-speech-input-and-memory-browse-t10-codex-mrar97i9

---

🤖 Generated by Code UX