feat: transcribe WeChat voice attachments

[richardzone]

Summary

• Add wx attachments --kind voice/audio support for voice message resources.
• Add voice extraction that prefers message/media_0.db::VoiceInfo.voice_data, with a file-cache fallback when available.
• Add wx transcribe <voice_attachment_id> for a local pipeline: WeChat voice bytes -> SILK decoder -> ffmpeg WAV -> whisper.cpp ASR.
• Document required local dependencies and privacy behavior for --keep-temp.

Safety / Privacy

• VoiceInfo lookup remains chat-scoped and create-time scoped when the schema provides those columns, avoiding cross-chat or same-chat local_id reuse leaks.
• wx transcribe uses a private temp directory (0700) and private intermediate files where wx-cli creates them (0600).
• No real wxid, message content, audio transcript, keys, tokens, or local user paths are included.

Validation

• cargo test --locked (136 passed)
• cargo run --locked -- transcribe --help
• git diff --cached --check
• staged sensitive scan for wxid/key/password/private-key style patterns

Notes

• wx-cli does not vendor SILK decoder, ffmpeg, whisper.cpp, or Whisper models; the new command calls local tools explicitly configured by flags or environment variables.
• The command is POC/experimental because WeChat voice storage varies by client version and local cache availability.