Fix stable blocker: real Persian TTS on Cloudflare runtime

[AmirMotefaker]

Browser evidence

Real Chrome acceptance on the merged-main 0.6.0 stable candidate now passes canonical branding, toolbar click, and page extraction, but Persian speech fails with: «صدای فارسی جایگزین روی این مرورگر در دسترس نیست.»

Root cause

The current Cloudflare runtime intentionally returns HTTP 503 for every POST /api/tts request with AVAYAR_SPEECH_BROWSER_FALLBACK_REQUIRED, while Chrome on the tested Windows environment exposes no usable fa/fa-IR Web Speech voice. Therefore the current fallback contract can never satisfy stable acceptance on this browser.

Fix scope

• implement real Gemini Persian TTS in cloudflare/worker.mjs for POST /api/tts
• preserve female Sulafat / male Iapetus voice selection
• return WAV audio with x-avayar-voice-name and x-avayar-voice-gender headers
• keep browser speech only as a secondary fallback
• bind GEMINI_API_KEY to avayar-runtime-preview from the GitHub avayar-preview environment during deploy
• replace the old 503 fallback smoke with a real audio E2E smoke
• never expose GEMINI_API_KEY to the extension bundle
• no stable release/store submission until real Chrome + Edge speech acceptance passes

Acceptance

• CI PASS
• Cloudflare preview deploy PASS
• /health reports server speech capability
• POST /api/tts returns 200 audio/wav for Persian input
• female and male voice preferences both pass E2E
• stable candidate rebuilt from exact merged-main SHA
• Chrome/Edge Play/Pause/Resume/Stop browser acceptance PASS

Refs #61