feat(voice): tool endpoints, timer widget, clean Siri-style overlay

Adds the infrastructure for Claude tool use + visual timer.

Tablet API surface (all bearer-authed with VOICE_API_KEY, middleware bypassed):
- /api/voice/tools/weather    — current + short forecast via Open-Meteo
- /api/voice/tools/transport  — tram arrivals by direction / route filter
- /api/voice/tools/events     — Google Calendar today/week
- /api/voice/tools/notes      — notes + shopping lists
- /api/voice/timer            — start (with seconds+label), cancel; GET list (cookie ok)
  Active timers persisted at /data/tablet-timers.json

UI:
- VoiceOverlay stripped to minimal Siri look: no agent emoji/name, just the
  pulsing orb (3-layer radial gradient, independent breath animations),
  subtle status label on wake only, transcription/response text centered.
  Agents distinguished by orb color (Cosmo indigo/violet, Люся pink).
- TimerWidget: bottom-right chip stack with countdown, progress bar, turns
  amber in last 10s. On expiry, fires fullscreen alarm overlay with beep
  (WebAudio osc) + Остановить button.

Other:
- lib/timers.ts — persistent timer store in /data
- lib/voice-tools.ts — shared bearer-auth helper
- middleware — bypass list now covers /api/voice/tools/* and /api/voice/timer

app/api/voice/tools/notes/route.ts

@@ -0,0 +1,30 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+  const r = await fetch(`${baseUrl}/api/notes`, {
+    cache: 'no-store',
+    headers: { cookie: '' },
+  }).catch(() => null)
+
+  if (!r || !r.ok) return NextResponse.json({ notes: [] }, { status: 502 })
+  const j = await r.json()
+  // Strip some fields to keep payload small for LLM context
+  const notes = (j.notes || []).slice(0, 10).map((n: any) => ({
+    id: n.id,
+    type: n.type,
+    title: n.title,
+    pin_date: n.pinDate,
+    items: n.type === 'shopping'
+      ? (n.items || []).map((i: any) => ({ text: i.text, done: !!i.done }))
+      : undefined,
+    text: n.type === 'note' ? (n.text || '').slice(0, 500) : undefined,
+  }))
+  return NextResponse.json({ notes })
+}