feat(voice): tool endpoints, timer widget, clean Siri-style overlay

Adds the infrastructure for Claude tool use + visual timer.

Tablet API surface (all bearer-authed with VOICE_API_KEY, middleware bypassed):
- /api/voice/tools/weather    — current + short forecast via Open-Meteo
- /api/voice/tools/transport  — tram arrivals by direction / route filter
- /api/voice/tools/events     — Google Calendar today/week
- /api/voice/tools/notes      — notes + shopping lists
- /api/voice/timer            — start (with seconds+label), cancel; GET list (cookie ok)
  Active timers persisted at /data/tablet-timers.json

UI:
- VoiceOverlay stripped to minimal Siri look: no agent emoji/name, just the
  pulsing orb (3-layer radial gradient, independent breath animations),
  subtle status label on wake only, transcription/response text centered.
  Agents distinguished by orb color (Cosmo indigo/violet, Люся pink).
- TimerWidget: bottom-right chip stack with countdown, progress bar, turns
  amber in last 10s. On expiry, fires fullscreen alarm overlay with beep
  (WebAudio osc) + Остановить button.

Other:
- lib/timers.ts — persistent timer store in /data
- lib/voice-tools.ts — shared bearer-auth helper
- middleware — bypass list now covers /api/voice/tools/* and /api/voice/timer

app/api/voice/timer/route.ts

@@ -0,0 +1,64 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { voiceBus } from '@/lib/voice-bus'
+import { addTimer, removeTimer, listActive } from '@/lib/timers'
+
+function bearerOk(req: Request): boolean {
+  const expected = process.env.VOICE_API_KEY
+  if (!expected) return false
+  const auth = req.headers.get('authorization') || ''
+  const token = auth.replace(/^Bearer\s+/i, '').trim()
+  return token === expected
+}
+
+export async function GET(req: Request) {
+  // Browser (cookie auth via middleware) will reach here — listing is public to logged-in user.
+  // Script with bearer can also GET it.
+  return NextResponse.json({ timers: listActive() })
+}
+
+export async function POST(req: Request) {
+  if (!bearerOk(req)) {
+    return NextResponse.json({ error: 'unauthorized' }, { status: 401 })
+  }
+
+  const body = await req.json().catch(() => null)
+  if (!body || typeof body.action !== 'string') {
+    return NextResponse.json({ error: 'action required' }, { status: 400 })
+  }
+
+  if (body.action === 'start') {
+    const seconds = Number(body.seconds)
+    const label = typeof body.label === 'string' ? body.label.slice(0, 80) : 'Таймер'
+    const agent = body.agent === 'lusya' ? 'lusya' : 'cosmo'
+    if (!Number.isFinite(seconds) || seconds < 1 || seconds > 24 * 3600) {
+      return NextResponse.json({ error: 'seconds must be 1..86400' }, { status: 400 })
+    }
+    const endsAt = new Date(Date.now() + seconds * 1000).toISOString()
+    const t = addTimer({ label, endsAt, agent })
+    voiceBus.emit('voice', {
+      event: 'timer_start',
+      timer: t,
+      timestamp: new Date().toISOString(),
+    })
+    return NextResponse.json({ timer: t })
+  }
+
+  if (body.action === 'cancel') {
+    const id = typeof body.id === 'string' ? body.id : ''
+    if (!id) return NextResponse.json({ error: 'id required' }, { status: 400 })
+    const ok = removeTimer(id)
+    if (ok) {
+      voiceBus.emit('voice', {
+        event: 'timer_cancel',
+        id,
+        timestamp: new Date().toISOString(),
+      })
+    }
+    return NextResponse.json({ cancelled: ok })
+  }
+
+  return NextResponse.json({ error: `unknown action: ${body.action}` }, { status: 400 })
+}

app/api/voice/tools/events/route.ts

@@ -0,0 +1,29 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const { searchParams } = new URL(req.url)
+  const range = searchParams.get('range') || 'today' // today | week
+
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+  const r = await fetch(`${baseUrl}/api/calendar?range=${encodeURIComponent(range)}`, {
+    cache: 'no-store',
+    headers: { cookie: '' },
+  }).catch(() => null)
+
+  if (!r || !r.ok) return NextResponse.json({ events: [], error: 'unreachable' }, { status: 502 })
+  const j = await r.json()
+  const events = (j.events || []).map((e: any) => ({
+    title: e.title,
+    start: e.start,
+    end: e.end,
+    all_day: e.allDay,
+    owner: e.ownerName || e.owner,
+  }))
+  return NextResponse.json({ events })
+}

app/api/voice/tools/notes/route.ts

@@ -0,0 +1,30 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+  const r = await fetch(`${baseUrl}/api/notes`, {
+    cache: 'no-store',
+    headers: { cookie: '' },
+  }).catch(() => null)
+
+  if (!r || !r.ok) return NextResponse.json({ notes: [] }, { status: 502 })
+  const j = await r.json()
+  // Strip some fields to keep payload small for LLM context
+  const notes = (j.notes || []).slice(0, 10).map((n: any) => ({
+    id: n.id,
+    type: n.type,
+    title: n.title,
+    pin_date: n.pinDate,
+    items: n.type === 'shopping'
+      ? (n.items || []).map((i: any) => ({ text: i.text, done: !!i.done }))
+      : undefined,
+    text: n.type === 'note' ? (n.text || '').slice(0, 500) : undefined,
+  }))
+  return NextResponse.json({ notes })
+}

app/api/voice/tools/transport/route.ts

@@ -0,0 +1,58 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+// Hardcoded for now — same as TransportWidget. Future: read from /data/tablet-config.json.
+const STOPS: Record<string, { id: string; name: string; direction: string }> = {
+  to_center:   { id: '16226', name: 'Ул. Антонова-Овсеенко', direction: 'в центр (к Новочеркасской)' },
+  from_center: { id: '16354', name: 'Ул. Антонова-Овсеенко', direction: 'от центра (к Большевиков)' },
+}
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const { searchParams } = new URL(req.url)
+  const dirRaw = (searchParams.get('direction') || 'all').toLowerCase()
+  const routesRaw = searchParams.get('routes') || '' // comma-separated
+
+  const dirsToQuery: { id: string; name: string; direction: string }[] =
+    dirRaw === 'to_center' ? [STOPS.to_center] :
+    dirRaw === 'from_center' ? [STOPS.from_center] :
+    [STOPS.to_center, STOPS.from_center]
+
+  const routeFilter = new Set(
+    routesRaw.split(',').map(r => r.trim()).filter(Boolean)
+  )
+
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+
+  const results = await Promise.all(
+    dirsToQuery.map(async (d) => {
+      const r = await fetch(`${baseUrl}/api/transport?stopId=${d.id}`, {
+        cache: 'no-store',
+        headers: { cookie: '' },
+      }).catch(() => null)
+      if (!r || !r.ok) return { direction: d.direction, stop_id: d.id, arrivals: [] }
+      const j = await r.json()
+      let arrivals = (j.arrivals || []) as Array<{ route: string; minutes: number; wheelchair?: boolean }>
+      if (routeFilter.size > 0) {
+        arrivals = arrivals.filter(a => routeFilter.has(a.route))
+      }
+      arrivals = arrivals.sort((a, b) => a.minutes - b.minutes).slice(0, 5)
+      return {
+        direction: d.direction,
+        stop_id: d.id,
+        stop_name: d.name,
+        arrivals: arrivals.map(a => ({
+          route: a.route,
+          minutes: a.minutes,
+          wheelchair: !!a.wheelchair,
+        })),
+      }
+    })
+  )
+
+  return NextResponse.json({ results })
+}

app/api/voice/tools/weather/route.ts

@@ -0,0 +1,84 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+const CITIES: Record<string, { name: string; lat: string; lon: string }> = {
+  spb:    { name: 'Санкт-Петербург', lat: '59.9343', lon: '30.3351' },
+  msk:    { name: 'Москва',          lat: '55.7558', lon: '37.6173' },
+  nsk:    { name: 'Новосибирск',     lat: '55.0084', lon: '82.9357' },
+  ekb:    { name: 'Екатеринбург',    lat: '56.8389', lon: '60.6057' },
+  kzn:    { name: 'Казань',          lat: '55.7887', lon: '49.1221' },
+  sochi:  { name: 'Сочи',            lat: '43.5855', lon: '39.7231' },
+  krd:    { name: 'Краснодар',       lat: '45.0355', lon: '38.9753' },
+}
+
+function resolveCity(raw: string | null): { lat: string; lon: string; name: string } {
+  if (!raw) return CITIES.spb
+  const q = raw.toLowerCase().trim()
+  for (const c of Object.values(CITIES)) {
+    if (c.name.toLowerCase().includes(q) || q.includes(c.name.toLowerCase())) return c
+  }
+  // common shorthands
+  if (q.includes('питер') || q.includes('спб') || q.includes('петерб')) return CITIES.spb
+  if (q.includes('москв') || q.includes('мск')) return CITIES.msk
+  if (q.includes('сочи')) return CITIES.sochi
+  if (q.includes('казан')) return CITIES.kzn
+  return CITIES.spb
+}
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const { searchParams } = new URL(req.url)
+  const city = resolveCity(searchParams.get('city'))
+
+  // Call our own /api/weather internally — its code already knows Open-Meteo.
+  // Use loopback so we don't need auth forwarding; weather route doesn't require auth actually
+  // (it just reads query and calls upstream).
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+  const r = await fetch(`${baseUrl}/api/weather?lat=${city.lat}&lon=${city.lon}`, {
+    cache: 'no-store',
+    headers: { cookie: '' }, // bypass middleware (we're public internally)
+  }).catch(() => null)
+
+  // Fallback: hit Open-Meteo directly if our own endpoint didn't respond
+  if (!r || !r.ok) {
+    const meteo = await fetch(
+      `https://api.open-meteo.com/v1/forecast?latitude=${city.lat}&longitude=${city.lon}` +
+      `&current=temperature_2m,apparent_temperature,relative_humidity_2m,wind_speed_10m,weather_code` +
+      `&timezone=auto`,
+      { cache: 'no-store' }
+    )
+    if (!meteo.ok) {
+      return NextResponse.json({ error: 'weather_unavailable' }, { status: 502 })
+    }
+    const j = await meteo.json()
+    const cur = j?.current || {}
+    return NextResponse.json({
+      city: city.name,
+      temp: Math.round(cur.temperature_2m ?? 0),
+      feels_like: Math.round(cur.apparent_temperature ?? 0),
+      humidity: Math.round(cur.relative_humidity_2m ?? 0),
+      wind_mps: Math.round(((cur.wind_speed_10m ?? 0) / 3.6) * 10) / 10,
+      weather_code: cur.weather_code,
+    })
+  }
+
+  const d = await r.json()
+  return NextResponse.json({
+    city: city.name,
+    temp: d.temp,
+    feels_like: d.feelsLike,
+    humidity: d.humidity,
+    wind: d.windSpeed,
+    desc: d.desc,
+    forecast: (d.forecast || []).slice(0, 5).map((day: any) => ({
+      date: day.date,
+      max: day.maxTemp,
+      min: day.minTemp,
+      desc: day.desc,
+    })),
+  })
+}