feat(asr): add Apple Speech provider (macOS 26+)

[erning]

Summary

Add Apple Speech as a new on-device ASR provider using Apple's SpeechAnalyzer and SpeechTranscriber APIs (macOS 26+). Zero-config, zero-download speech recognition with system-managed language assets.

• New KoeAppleSpeech Swift package bridges Apple's Speech framework to Rust via C FFI
• Audio flows as PCM16 → AsyncStream<AnalyzerInput> → SpeechAnalyzer → progressive transcription
• Results accumulated using Apple's official result.isFinal model: finalized segments build a stable prefix, volatile segments show in-progress recognition — no string-overlap heuristics
• Dictionary entries passed as contextualStrings for vocabulary bias
• Speech assets managed by macOS via AssetInventory (download/release/status through FFI)
• Setup Wizard: language picker, asset status indicator, download/release buttons
• Speech Recognition permission: requested at startup, checked defensively at session start, shown in menu bar

Implementation

Layer	Detail
Swift (KoeAppleSpeech)	AppleSpeechManager — session lifecycle, audio bridging, finalizedTranscript + volatileTranscript accumulation; CBridge — @_cdecl FFI for session control and asset management
Rust (koe-asr)	AppleSpeechProvider — FFI wrapper, PCM routing, tokio mpsc event channel
Rust (koe-core)	Provider creation from asr.provider = "apple-speech" config, locale and dictionary wiring
Obj-C (KoeApp)	Setup Wizard UI (locale popup, asset status, download/release), permission flow, status bar permission item

Runtime requirements

• Minimum deployment target: macOS 14.0 (unchanged)
• Apple Speech requires: macOS 26.0+ — all code paths gated with @available(macOS 26.0, *); invisible on older systems
• New permission: NSSpeechRecognitionUsageDescription in Info.plist (only needed for Apple Speech)
• Feature flag: apple-speech (enabled by default, excludable with --no-default-features)

App bundle changes

• Size increase: ~100–200 KB (compiled Swift, no embedded models)
• No bundled models: speech assets are system-managed, downloaded on-demand
• New framework: Speech.framework (system framework, always present)
• Zero new third-party dependencies

Test plan

• Build succeeds on macOS 26 (Apple Silicon and Intel targets)
• Build succeeds on macOS < 26 (code compiles, runtime-gated)
• Setup Wizard: Apple Speech option only appears on macOS 26+
• Setup Wizard: language picker populates, saved locale restores correctly
• Setup Wizard: asset download/release work, status updates
• Speech Recognition permission requested at startup when apple-speech configured
• Menu bar shows Speech Recognition permission status when applicable
• Short utterance recognized and pasted correctly
• Long utterance (30s+): finalized segments accumulate, no truncation
• Mixed Chinese/English transcription works
• Provider switching (doubao → apple-speech → mlx) works without restart
• Other providers (Doubao, Qwen, MLX, sherpa-onnx) unaffected

[missuo]

Review: PR #40 — feat(asr): add Apple Speech provider (macOS 26+)

Overall: Well-structured, follows existing patterns (KoeMLX). A few concerns:

Architecture

• Good: Follows the same FFI pattern as KoeMLX (Swift → C → Rust), generation-based session management, callback locking
• Good: @available(macOS 26.0, *) gating throughout, invisible on older systems
• Good: Asset management FFI for Setup Wizard integration

Concerns

1. Semaphore + Task pattern in CBridge.swift — _supportedLocalesImpl, _assetStatusImpl, _releaseAssetImpl all use DispatchSemaphore.wait() to block the calling thread while spawning a Task. If called from the main thread, this deadlocks if the async work needs main-thread access. Consider documenting these must be called from a background thread, or use a different synchronization pattern.

2. SFSpeechRecognizer.requestAuthorization with semaphore in koeAppleSpeechStartSession — same deadlock risk if called from main thread.

3. Memory safety of event_tx_ptr — The leaked Box<Sender> pattern works but is fragile. If connect() is called twice without close(), the first sender leaks. The reclaim_sender in close() and Drop helps, but connect() should call reclaim_sender() at the top to handle re-connection.

4. audioFormat force-unwrap — AVAudioFormat(...)! in AppleSpeechManager will crash if the format is unsupported. Unlikely for 16kHz mono Int16, but a guard with error callback would be safer.

5. Missing Definite events — The provider only emits Interim (type 0) and Final (type 2). The result.isFinal is used to accumulate finalized segments internally, but no Definite (type 1) events are sent upstream. This means the core's TranscriptAggregator won't receive definite confirmations. Is this intentional?

Minor

• .build/ gitignore addition is good (SPM build directory)
• apple-speech feature flag name is consistent with sherpa-onnx convention