fix: retire Kokoro and migrate voice settings to Piper

[atomantic]

Kokoro is retired in favor of the existing Piper backend. Upgrades migrate saved Kokoro settings while preserving custom Piper choices, disabled voice state, and historical profile/audio records. Settings → Voice explains the switch and directs users to Save & Reconcile; upgraded installs wait for that action before provisioning Piper.

The change removes kokoro-js, 44 lockfile package entries, and the exclusive tar/protobufjs overrides. Voice catalogs, health checks, setup defaults, and API metadata now use the supported engines. Cached memory-management endpoints remain safe no-ops. Retired character presets/profiles return an actionable error so users can select/promote a Piper replacement.

Validation: full server suite (43,313 passed), 40 focused client tests, client lint and production build. Migration tests cover preservation, repeat runs, absent settings, malformed input, and restored/old-client settings. A boot test verifies that pending Piper setup triggers no downloads or model preload.

The configured optional Claude review ran at medium effort with tools disabled, but returned malformed output with no verdict; it is recorded as inconclusive. Manual diff review completed. A pre-existing time-capsule guard false positive was classified with its immutable UUID snapshot lifecycle.

Closes #7011

[atomantic]

Implementation and local validation are complete, but this PR is intentionally left open: CI run 34648165204 was canceled on all three attempts before the server/client/Windows jobs could finish. CI Gate and Full CI Gate failed because those jobs were canceled. Database CI passed.

Local validation: 43,313 server tests passed; 40 focused client tests passed; client lint and build passed. The optional Claude review returned malformed output without a verdict and is recorded as inconclusive.

The three-round CI limit is reached. No merge was attempted. The branch and issue claim markers are preserved for resuming after the CI cancellation cause is resolved; the local worktree is removed.

[atomantic]

Completed the configured Claude review round against aeaa879 with enforced Read/Glob/Grep-only tools, plan mode, MCP/hooks/plugins/Chrome disabled, and medium effort. The worktree remained unchanged. Status: no-verdict (optional, inconclusive) because stdout included prose before the finding blocks. Budget: 1/1 rounds; no substitute reviewer was used.

Independently verified and fixed all four reported issues in 34b6ec0:

• Fresh settings now seed Piper without a retirement marker.
• Upgraded installs still start provisioned Whisper while Piper setup and LLM preload remain deferred.
• Successful enabled Save & Reconcile removes the retirement marker; disabled or failed reconciliation preserves it.
• Voice setup documentation and flow labels describe supported engines.

Also traced the cancelled CI run to the Windows trusted-rebuild guard's stale minimum count after Kokoro dependency removal. Removed that numeric assumption while retaining the explicit node-pty witness and all per-package accounting assertions.

Validation: 104 focused tests passed, including migration, configuration preservation, lifecycle, route failure paths, and trusted rebuild guards. Production client build passed using isolated temporary dependencies because the shared checkout lacked @scalar/api-reference-react. Current-head CI remains the final merge gate.