Closes #1743

Summary

This PR adds OpenAI-compatible audio API endpoints to AxonHub:

• POST /v1/audio/speech — text-to-speech (TTS), binary audio response
• POST /v1/audio/transcriptions — speech-to-text (STT), multipart upload
• POST /v1/audio/translations — speech-to-text translation, multipart upload

It also supports SSE streaming for both directions:

• TTS stream_format: "sse" (gpt-4o-mini-tts)
• STT stream: true (gpt-4o-transcribe)

The binary chunked TTS stream (the OpenAI default without stream_format) is intentionally out of scope — it would require a third response carrier (raw byte stream) on top of the existing JSON / SSE pipeline, and most clients already accept SSE streaming.

Changes

Backend

Unified models

• llm/audio.go (new): SpeechRequest, TranscriptionRequest, TranslationRequest, plus their non-streaming responses and SpeechStreamEvent / TranscriptionStreamEvent for SSE.
• llm/model.go: Request and Response carry the audio sub-structs and stream events alongside existing Embedding / Image / Video fields.
• llm/constants.go: three new request types and three new API formats (openai/audio_speech, openai/audio_transcriptions, openai/audio_translations).

OpenAI transformer

• llm/transformer/openai/audio_inbound.go (new): parses JSON (speech) and multipart (STT) requests with fail-fast validation (model, input, voice, file required; invalid temperature / stream rejected; duplicate file parts rejected; client-controlled filenames sanitized). Implements TransformResponse / TransformStream / AggregateStreamChunks.
• llm/transformer/openai/audio_outbound.go (new): builds JSON / multipart provider requests, sets the right Accept header (*/* for binary TTS, text/event-stream for SSE), parses provider responses and SSE events.
• llm/transformer/openai/outbound.go: TransformRequest / TransformResponse / TransformStream / AggregateStreamChunks dispatch the new audio formats to the dedicated audio code.
• Stream-level errors (event: error or {"error":{...}}) flowing in after a 200 response are surfaced as stream errors via parseStreamErrorEvent, instead of being silently decoded as empty audio events.

Pipeline

• llm/pipeline/empty_response.go: hasResponseContent recognises Speech.Audio, Transcription.Text/Raw, and the two new stream-event carriers so audio responses do not trigger empty-response retries.
• llm/httpclient/client.go: Do only sets the default Accept: application/json when the transformer did not already set one (TTS needs */*).
• llm/httpclient/utils.go: Accept is added to blockedHeaders so inbound client values cannot override the transformer-owned Accept.

Delegating channels (NanoGPT / OpenRouter)

• llm/transformer/nanogpt/outbound.go and llm/transformer/openrouter/outbound.go: TransformResponse / TransformStream / AggregateStreamChunks delegate audio requests to the embedded OpenAI outbound so transcript / speech events are not parsed as chat completions.

Orchestrator & persistence

• internal/server/api/openai.go and routes.go: three new handlers wired into the existing ChatCompletion orchestrator (reusing pipeline, quota, persistence, retries, etc.).
• internal/server/orchestrator/select_endpoints.go: per-request-type allow-lists added for speech / transcription / translation.
• internal/server/orchestrator/request.go: persistence is JSON-column-safe — TTS binary audio is replaced with a compact metadata placeholder and offloaded to external DataStorage (mirroring how video artifacts are stored), and non-JSON STT bodies (text / srt / vtt) are wrapped into a JSON object. Determined by Content-Type first; sniffing only when absent.
• internal/server/orchestrator/request_execution.go: execution-record format uses the actual outbound request APIFormat instead of the wrapper's primary format, so audio executions are tracked correctly (chat-only APIFormat() would otherwise mis-tag them).
• internal/server/orchestrator/pass_through.go: multipart audio formats are excluded from body pass-through because the outbound transformer rebuilds the multipart payload with a new boundary; speech keeps pass-through with model-patch support.
• internal/server/orchestrator/inbound.go: isTerminalStreamEvent recognises speech.audio.done and transcript.text.done so audio SSE streams that omit [DONE] still mark the request as completed.
• internal/server/biz/request.go: new UpdateRequestCompletedWithAudio and GenerateAudioKey for offloading TTS audio to external storage.
• internal/server/biz/channel_endpoint.go and channel_llm.go: audio endpoints are exposed as configurable, plus default endpoints for OpenAI, NanoGPT, and OpenRouter (other OpenAI-compatible channels can opt in via custom endpoints — they are not auto-enabled to avoid mis-routing to providers that may not actually support the audio APIs).

Frontend

• frontend/src/features/channels/data/schema.ts: register the new API formats.
• frontend/src/features/models/components/models-association-dialog.tsx: audio formats appear in the association filter options.
• frontend/src/features/models/data/providers.json: gpt-4o-mini-tts added.
• frontend/src/features/requests/components/request-detail-content.tsx: inline audio playback for completed TTS requests, with a download fallback and a dedicated load-failure state instead of silently showing "no response data".
• frontend/src/features/requests/utils/curl-generator.ts: cURL preview emits -F flags for STT (multipart) instead of JSON -d, and drops the logged Content-Type (carries a stale boundary).
• i18n strings added for both en and zh-CN.

Tests

• llm/transformer/openai/audio_inbound_test.go, audio_outbound_test.go (new): cover JSON / multipart parsing, fail-fast validation (voice, temperature, duplicate file, unsupported stream_format), verbose_json raw passthrough, content-type-aware response wrapping, multipart filename header-injection defence, end-to-end round trip (non-stream + SSE TTS + SSE STT), and stream-level error propagation.
• llm/pipeline/empty_response_test.go: new cases for audio response and stream-event content detection.
• llm/httpclient/utils_test.go: Accept header is no longer overridden by the inbound request.
• internal/server/orchestrator/request_test.go: audioSafeResponseBody matrix and end-to-end TTS persistence test (binary stored externally, JSON column holds metadata).
• internal/server/orchestrator/pass_through_test.go: multipart audio is excluded from pass-through; speech pass-through still patches the model.
• internal/server/orchestrator/inbound_test.go: terminal-event detection covers speech.audio.done and transcript.text.done.
• internal/server/biz/request_audio_test.go (new): TTS audio offloaded to external DataStorage, request row references it via content_storage_*.
• internal/server/biz/channel_endpoint_mapping_test.go, channel_llm_*_test.go: default endpoint maps updated to reflect the restricted audio rollout.

Compatibility

• Existing chat / completions / embeddings / image / video routes are unchanged.
• Other OpenAI-compatible channels (Vercel, DeepInfra, PPIO, SiliconFlow, AtlasCloud, Aihubmix, Burncloud, GitHub Models) do not receive audio default endpoints automatically; they keep the previous six-endpoint default and can opt in via custom endpoints.
• Accept header semantics change for HTTP requests where the outbound transformer set it explicitly — the previous behaviour unconditionally overwrote it with application/json. All in-tree transformers already set their intended Accept explicitly, so the user-visible behaviour is unchanged outside of audio.

Out of scope

• TTS default binary chunked stream (stream_format not set): requires a new raw-byte response carrier in the pipeline and the WriteSSEStream writer; tracked as a follow-up. Clients can use stream_format: "sse" for streaming TTS today, or fall back to the non-streaming path.