feat: Geräte-TTS, native Stimmen, Favicon, Auth-Gate, UI-Fixes

Web-UI / TTS:
- Geräte-TTS ("📱 Gerät"): Antwort wird on-device vorgelesen (Web Speech
  API), Server sendet nur Text (text_only) -> spart Bandbreite/Kosten.
  Mobil-Default, geräte-lokale Speicherung, iOS-Autoplay-Freischaltung.
- Vorlese-Symbol (🔊) je Bubble: Hybrid-Replay (Assistent-PCM gecacht,
  Eingabe via /api/speak); SVG-Icon mit kontrastreicher Farbe.
- Kombiniertes Sprachmenü (Flex + feste Sprachen) statt separatem Modus-Menü.
- "Neues Gespräch"-Button (frische Session gegen Sprach-Trägheit).
- Dark-Mode: lesbare <option>-Popups (Kontrast-Fix).
- Favicon (SVG + PNG-Fallbacks) aus mund.png.

TTS-Backend:
- Sprache wird an alle TTS-Provider durchgereicht; Piper-Stimme folgt der
  Sprache; Chatterbox mehrsprachig + cross-lingual.
- Native Referenz-Stimmen je Sprache (config/voices/<lang>.wav, FLEURS CC-BY),
  loudness-normalisiert.

LLM-Sprache:
- Antwort folgt zuverlässig der gewählten Sprache (verstärkte Anweisung +
  Erinnerung an der letzten Nutzer-Nachricht gegen History-Trägheit).

Admin / Auth:
- Wörterbuch: alle 8 Sprachen, Zeilen editierbar, alphabetische Sortierung.
- Web-UI hinter Auth-Gate (Redirect auf SSO_LOGIN_URL / 401); Favicons offen.
- Log-Tab: Hinweis, wenn der systemd-Dienst nicht aktiv ist.
- Einstellungen: Hinweis "pro Nutzer überschreibbar" bei Sprache/Modus/Qualität.

Doku (BEDIENUNGSANLEITUNG.md): Geräte-TTS §6.5.0, Fix/Flex §6.6, native
Stimmen §6.5.3, llama.cpp<->Ollama-Wechsel §4.7, Auth/SSO §7.4.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/ws.py

@@ -26,6 +26,7 @@ from app.dependencies import (
     resolve_route,
     build_orchestrator,
     resolve_output_endpoint,
+    piper_voice_for_language,
 )
 from app.store import ANONYMOUS_USER_ID, SessionOwnershipError
 from app.audio.vad import EnergyVAD
@@ -40,6 +41,7 @@ _OVERRIDE_KEYS = (
     "input_endpoint",
     "output_endpoint",
     "language",
+    "language_mode",
     "stt_provider",
     "llm_provider",
     "tts_provider",
@@ -62,7 +64,10 @@ async def _resolve(user, session_id, options):
     return route, orchestrator, output
 
 
-async def _run_turn(websocket, store, user, session_id, route, orchestrator, output, text, options):
+async def _run_turn(
+    websocket, store, user, session_id, route, orchestrator, output, text, options,
+    detected_language: str | None = None, effective_voice: str | None = None,
+):
     """Faehrt einen Antwort-Turn und streamt die Events an den Client."""
     conversation = (
         store.get_recent_messages(session_id, settings.history_max_messages)
@@ -108,13 +113,24 @@ async def _run_turn(websocket, store, user, session_id, route, orchestrator, out
 
     await websocket.send_json({"type": "ack", "route": route.as_dict()})
 
-    # Ohne explizite Stimme None lassen -> jeder TTS-Provider nimmt SEINEN Default
-    # (OpenRouter: OPENROUTER_TTS_VOICE, piper: PIPER_VOICE).
-    voice = options.get("voice")
+    # Stimme: explizit angeforderte gewinnt, sonst die vom Caller (Sprach-Turn)
+    # vorberechnete sprachpassende Stimme, sonst folgt sie der Routensprache
+    # (greift v. a. beim Text-Chat ohne Spracherkennung).
+    explicit_voice = options.get("voice")
+    if explicit_voice:
+        voice = explicit_voice
+    elif effective_voice is not None:
+        voice = effective_voice
+    else:
+        voice = piper_voice_for_language(route.tts_provider, route.language)
     stream = bool(options.get("stream"))
+    # text_only: Geräte-TTS (Web Speech API) spricht selbst -> kein Server-Audio erzeugen/senden.
+    text_only = bool(options.get("text_only"))
     # audio_stream: explizite Anfrage gewinnt, sonst der serverseitige Default (Admin).
-    audio_stream = bool(options["audio_stream"]) if "audio_stream" in options \
+    audio_stream = False if text_only else (
+        bool(options["audio_stream"]) if "audio_stream" in options
         else settings.audio_stream_default
+    )
 
     on_token = None
     if stream:
@@ -141,6 +157,9 @@ async def _run_turn(websocket, store, user, session_id, route, orchestrator, out
                 history=llm_context,
                 on_token=on_token,
                 on_audio=on_audio,
+                language_mode=route.language_mode,
+                detected_language=detected_language,
+                text_only=text_only,
             )
         else:
             trace, audio = await orchestrator.chat_text(
@@ -149,6 +168,9 @@ async def _run_turn(websocket, store, user, session_id, route, orchestrator, out
                 voice=voice,
                 output=output,
                 history=llm_context,
+                language_mode=route.language_mode,
+                detected_language=detected_language,
+                text_only=text_only,
             )
     except Exception as exc:
         await websocket.send_json({"type": "error", "status": 502, "detail": str(exc)})
@@ -164,7 +186,8 @@ async def _run_turn(websocket, store, user, session_id, route, orchestrator, out
     await websocket.send_json(
         {"type": "semantic", "text": trace.semantic_response, "spoken": trace.spoken_response}
     )
-    if not audio_stream:
+    # Im text_only-Modus kommt kein Audio (Gerät spricht selbst).
+    if not audio_stream and not text_only:
         await websocket.send_bytes(audio)
     await websocket.send_json({"type": "done", "audio_format": "pcm", "sample_rate": 24000})
 
@@ -202,19 +225,42 @@ async def _voice_turn(websocket, store, user, session_id, audio, fmt, options):
     except RoutingError as exc:
         await websocket.send_json({"type": "error", "status": 422, "detail": str(exc)})
         return
+
     try:
-        transcript = await orchestrator.stt.transcribe(audio, fmt=fmt, language=route.language)
+        if route.language_mode == "flex":
+            # Flex: Sprache auto-erkennen, kein Übersetzen durch Whisper.
+            transcript, detected_language = await orchestrator.stt.transcribe_detect(
+                audio, fmt=fmt, language=None
+            )
+            # Stimme folgt der erkannten Sprache (Fallback: Routensprache).
+            effective_voice = piper_voice_for_language(
+                route.tts_provider, detected_language or route.language
+            )
+        else:
+            # Fix: konfigurierte Sprache an Whisper → Whisper übersetzt automatisch.
+            transcript = await orchestrator.stt.transcribe(audio, fmt=fmt, language=route.language)
+            detected_language = None
+            # Stimme folgt der konfigurierten Sprache.
+            effective_voice = piper_voice_for_language(route.tts_provider, route.language)
     except Exception as exc:
         await websocket.send_json({"type": "error", "status": 502, "detail": str(exc)})
         return
-    await websocket.send_json({"type": "transcript", "text": transcript})
+
+    await websocket.send_json({
+        "type": "transcript",
+        "text": transcript,
+        "detected_language": detected_language,
+    })
     if not transcript or not transcript.strip():
         await websocket.send_json({
             "type": "error",
             "detail": "Keine Sprache erkannt — bitte erneut sprechen.",
         })
         return
-    await _run_turn(websocket, store, user, session_id, route, orchestrator, output, transcript, options)
+    await _run_turn(
+        websocket, store, user, session_id, route, orchestrator, output, transcript, options,
+        detected_language=detected_language, effective_voice=effective_voice,
+    )
 
 
 @router.websocket("/ws/chat")