feat(voice): tool endpoints, timer widget, clean Siri-style overlay

Adds the infrastructure for Claude tool use + visual timer.

Tablet API surface (all bearer-authed with VOICE_API_KEY, middleware bypassed):
- /api/voice/tools/weather    — current + short forecast via Open-Meteo
- /api/voice/tools/transport  — tram arrivals by direction / route filter
- /api/voice/tools/events     — Google Calendar today/week
- /api/voice/tools/notes      — notes + shopping lists
- /api/voice/timer            — start (with seconds+label), cancel; GET list (cookie ok)
  Active timers persisted at /data/tablet-timers.json

UI:
- VoiceOverlay stripped to minimal Siri look: no agent emoji/name, just the
  pulsing orb (3-layer radial gradient, independent breath animations),
  subtle status label on wake only, transcription/response text centered.
  Agents distinguished by orb color (Cosmo indigo/violet, Люся pink).
- TimerWidget: bottom-right chip stack with countdown, progress bar, turns
  amber in last 10s. On expiry, fires fullscreen alarm overlay with beep
  (WebAudio osc) + Остановить button.

Other:
- lib/timers.ts — persistent timer store in /data
- lib/voice-tools.ts — shared bearer-auth helper
- middleware — bypass list now covers /api/voice/tools/* and /api/voice/timer

app/api/voice/tools/events/route.ts

@@ -0,0 +1,29 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const { searchParams } = new URL(req.url)
+  const range = searchParams.get('range') || 'today' // today | week
+
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+  const r = await fetch(`${baseUrl}/api/calendar?range=${encodeURIComponent(range)}`, {
+    cache: 'no-store',
+    headers: { cookie: '' },
+  }).catch(() => null)
+
+  if (!r || !r.ok) return NextResponse.json({ events: [], error: 'unreachable' }, { status: 502 })
+  const j = await r.json()
+  const events = (j.events || []).map((e: any) => ({
+    title: e.title,
+    start: e.start,
+    end: e.end,
+    all_day: e.allDay,
+    owner: e.ownerName || e.owner,
+  }))
+  return NextResponse.json({ events })
+}