feat(voice): tool endpoints, timer widget, clean Siri-style overlay

Adds the infrastructure for Claude tool use + visual timer.

Tablet API surface (all bearer-authed with VOICE_API_KEY, middleware bypassed):
- /api/voice/tools/weather    — current + short forecast via Open-Meteo
- /api/voice/tools/transport  — tram arrivals by direction / route filter
- /api/voice/tools/events     — Google Calendar today/week
- /api/voice/tools/notes      — notes + shopping lists
- /api/voice/timer            — start (with seconds+label), cancel; GET list (cookie ok)
  Active timers persisted at /data/tablet-timers.json

UI:
- VoiceOverlay stripped to minimal Siri look: no agent emoji/name, just the
  pulsing orb (3-layer radial gradient, independent breath animations),
  subtle status label on wake only, transcription/response text centered.
  Agents distinguished by orb color (Cosmo indigo/violet, Люся pink).
- TimerWidget: bottom-right chip stack with countdown, progress bar, turns
  amber in last 10s. On expiry, fires fullscreen alarm overlay with beep
  (WebAudio osc) + Остановить button.

Other:
- lib/timers.ts — persistent timer store in /data
- lib/voice-tools.ts — shared bearer-auth helper
- middleware — bypass list now covers /api/voice/tools/* and /api/voice/timer

app/api/voice/tools/transport/route.ts

@@ -0,0 +1,58 @@
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+
+import { NextResponse } from 'next/server'
+import { isBearerAuthorized, unauthorized } from '@/lib/voice-tools'
+
+// Hardcoded for now — same as TransportWidget. Future: read from /data/tablet-config.json.
+const STOPS: Record<string, { id: string; name: string; direction: string }> = {
+  to_center:   { id: '16226', name: 'Ул. Антонова-Овсеенко', direction: 'в центр (к Новочеркасской)' },
+  from_center: { id: '16354', name: 'Ул. Антонова-Овсеенко', direction: 'от центра (к Большевиков)' },
+}
+
+export async function GET(req: Request) {
+  if (!isBearerAuthorized(req)) return unauthorized()
+
+  const { searchParams } = new URL(req.url)
+  const dirRaw = (searchParams.get('direction') || 'all').toLowerCase()
+  const routesRaw = searchParams.get('routes') || '' // comma-separated
+
+  const dirsToQuery: { id: string; name: string; direction: string }[] =
+    dirRaw === 'to_center' ? [STOPS.to_center] :
+    dirRaw === 'from_center' ? [STOPS.from_center] :
+    [STOPS.to_center, STOPS.from_center]
+
+  const routeFilter = new Set(
+    routesRaw.split(',').map(r => r.trim()).filter(Boolean)
+  )
+
+  const baseUrl = `http://localhost:${process.env.PORT || '3000'}`
+
+  const results = await Promise.all(
+    dirsToQuery.map(async (d) => {
+      const r = await fetch(`${baseUrl}/api/transport?stopId=${d.id}`, {
+        cache: 'no-store',
+        headers: { cookie: '' },
+      }).catch(() => null)
+      if (!r || !r.ok) return { direction: d.direction, stop_id: d.id, arrivals: [] }
+      const j = await r.json()
+      let arrivals = (j.arrivals || []) as Array<{ route: string; minutes: number; wheelchair?: boolean }>
+      if (routeFilter.size > 0) {
+        arrivals = arrivals.filter(a => routeFilter.has(a.route))
+      }
+      arrivals = arrivals.sort((a, b) => a.minutes - b.minutes).slice(0, 5)
+      return {
+        direction: d.direction,
+        stop_id: d.id,
+        stop_name: d.name,
+        arrivals: arrivals.map(a => ({
+          route: a.route,
+          minutes: a.minutes,
+          wheelchair: !!a.wheelchair,
+        })),
+      }
+    })
+  )
+
+  return NextResponse.json({ results })
+}