fix(voice): allow WASM compilation in CSP for Silero VAD

Add 'wasm-unsafe-eval' to script-src and blob: to worker-src in
Content-Security-Policy header. Required by onnxruntime-web to compile
the Silero VAD ONNX model. Also surface VAD init errors as a toast
instead of silent console log.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/components/ChatInputBar.vue

@@ -153,10 +153,11 @@ const vad = useVad({
     void stopRecording(false)
   },
   onNoSpeech: () => {
-    // User manually stopped without VAD detecting speech. Toast it; the
-    // stopRecording path below will skip Whisper based on vadSawSpeech.
     useToastStore().show('No speech detected', 'warning')
   },
+  onVadError: (msg) => {
+    useToastStore().show(`VAD failed: ${msg}`, 'error')
+  },
 })
 
 // Live mic halo. A solid red disc sits behind the mic button and scales

frontend/src/composables/useVad.ts

@@ -2,13 +2,10 @@ import { ref, readonly } from 'vue'
 import type { MicVAD } from '@ricky0123/vad-web'
 
 export interface UseVadOptions {
-  /** Called when VAD detects a real speech-end event after the grace period. */
   onSpeechEnd: () => void
-  /** Called when stopAndCheck() is invoked but no speech was ever detected. */
   onNoSpeech: () => void
-  /** Minimum ms between speech-start and speech-end before the end event fires. */
+  onVadError?: (message: string) => void
   graceMs?: number
-  /** Minimum total recording duration before speech-end can fire. */
   minRecordingMs?: number
 }
 
@@ -108,8 +105,8 @@ export function useVad(options: UseVadOptions) {
       await micVad.start()
       loaded.value = true
     } catch (e) {
-      // VAD init failed — the user can still manual-stop. Log for debugging.
       console.error('VAD init failed:', e)
+      options.onVadError?.(e instanceof Error ? e.message : String(e))
     }
   }