[longzhi]

Closes #161. Stacked on #168 (sign-in), so the base is its branch; once #168 merges, GitHub retargets this to main.

What changes

• Recognition and synthesis call /v1/voice/transcribe and /v1/voice/speak with Authorization: Bearer <session> (docs/api.md).
• No session: nothing is sent. Recognition fails as signed_out, and synthesis leaves the reply as text.
• 401: the daemon forgets the session, which signs out. The App sees it through the status stream, and the box is told voice is off.
• 429: passed to the box as voice.error with reason allowance or global_cap, and a short message that current firmware shows as a voice error. What the box should really say is Voice commands: talk to your Agents through the box #132. A refused spoken reply stays text, as any synthesis failure does.
• voice.available: with the voice service, it is on only while signed in (Recognizer::ready). The user's own recognizer needs no account. Signing in or out, here or by a 401, tells the box again (follow_account).
• Recognizer errors now carry the reason the box is told (RecognitionError). Plain failures stay unavailable.
• docs/protocol.md lists the three new voice.error reasons.

Two choices against the ticket's text, for review

• Release builds still have no service. The ticket says they should use https://api.korekore.ai, but production has no route until vibebuddy-cloud#11. Pointing a release there now would show "Sign in" in a release and then fail. feat(app): 用菜单栏的像素脸生成 App 图标 #11 should flip service_base when production opens.
• voice.available stays on after an allowance or cap refusal. Turning it off would need a timer to turn it back on at 00:00 UTC. Each turn gets the reason anyway.

Checked

• cargo test --workspace --locked: all pass. The daemon has 337, 3 of them new:
  • the session header, and ready() turning false once signed out with nothing sent;
  • 401, 429 allowance and global_cap and an unparsable 429 each mapped to its reason, with only a 401 forgetting the session;
  • synthesis carrying the session, forgetting it on a 401, then sending nothing more.
• The existing v0 path tests were moved to v1.
• cargo clippy --workspace --all-targets --locked: no new warnings.
• Not checked on a box. A voice command with a signed-in daemon on staging needs the box and the resident session. The service side is checked (vibebuddy-cloud#13), and so is sign-in (Sign in to the VibeBuddy account from the Apps #168).

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.