refactor: isolate transcription product for dual-cvm split

[daopunk]

Summary

Finishes issue #8 (under umbrella #10): deepen the dual-CVM boundary by extracting transcription into workspace crates, adding translation-led pairing UX, and closing out ops/docs for the standalone 4 GB transcription CVM.

Dual-CVM ops (compose/Phala, BOT__ROLE, Whisper on TX only, Signal as bus) are already in place. This PR covers the remaining crate boundary, pairing, and docs/ops close-out. Website/Stripe (#13) and translation product relay semantics stay out of scope.

Crate split

• Add signal-bot-core — shared CommandHandler + AppResult so TX/TR do not form a Cargo cycle
• Add signal-bot-transcription — owns voice/transcribe handlers, stores, and build_transcription_handlers
• Keep one signal-bot binary and image; thin handlers_setup role match; Dockerfile cache stubs for the new crates

Pairing UX (translation leads)

• SIGNAL__PEER_PHONE on both stacks; translation invites the transcription bot into the group
• Replace TranscriptionStubHandler with invite-or-silent pairing
• Transcription answers !transcription once it is in the group

Ops / docs

• docs/voice-transcription.md + architecture/product table links
• Phala env examples; fix stale Language Threads co-located Whisper wording
• Target Phala tdx.medium (4 GB); no cross-CVM HTTP

Out of scope

• Website / Stripe (Website + Stripe: product suite checkout and subscriptions #13)
• Parallel / Language Threads / in-chat relay semantics
• Separate git repo or second binary/image for transcription
• Cargo features to omit Whisper from translation builds

Test plan

• Unit tests move with relocated modules; Group members deserialize; pairing invite / already-paired / missing peer; TX !transcription menu
• handlers_setup expectations updated for new labels
• npm run ci (fmt, clippy -D warnings, ≥90% llvm-cov)

Closes #8