fix: stabilize browser speech input on Android

[chenyme]

Summary

Fixes #580 by hardening the browser speech-recognition lifecycle, especially for Android Chrome.

Voice input now distinguishes startup from active listening, preserves transcripts across short recognition sessions, follows the application locale, limits empty automatic retries, and displays localized browser-service errors instead of showing an indefinite listening animation.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• pnpm check
• Biome lint
• TypeScript typecheck
• git diff --check
• English and Simplified Chinese message JSON parsing
• Android Chrome runtime verification; requires a physical device or compatible browser environment.

Screenshots, API examples, or logs

No screenshots or API contract changes.

Configuration, migration, and compatibility notes

No configuration, database migration, deployment, or API changes are required.

The implementation continues to use the browser Web Speech API. Browser speech-service availability, microphone permissions, and network requirements still apply.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Microphone access remains controlled by browser permissions, and no additional audio stream or server-side recording was introduced.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.