feat(voice): tool endpoints, timer widget, clean Siri-style overlay

Adds the infrastructure for Claude tool use + visual timer.

Tablet API surface (all bearer-authed with VOICE_API_KEY, middleware bypassed):
- /api/voice/tools/weather    — current + short forecast via Open-Meteo
- /api/voice/tools/transport  — tram arrivals by direction / route filter
- /api/voice/tools/events     — Google Calendar today/week
- /api/voice/tools/notes      — notes + shopping lists
- /api/voice/timer            — start (with seconds+label), cancel; GET list (cookie ok)
  Active timers persisted at /data/tablet-timers.json

UI:
- VoiceOverlay stripped to minimal Siri look: no agent emoji/name, just the
  pulsing orb (3-layer radial gradient, independent breath animations),
  subtle status label on wake only, transcription/response text centered.
  Agents distinguished by orb color (Cosmo indigo/violet, Люся pink).
- TimerWidget: bottom-right chip stack with countdown, progress bar, turns
  amber in last 10s. On expiry, fires fullscreen alarm overlay with beep
  (WebAudio osc) + Остановить button.

Other:
- lib/timers.ts — persistent timer store in /data
- lib/voice-tools.ts — shared bearer-auth helper
- middleware — bypass list now covers /api/voice/tools/* and /api/voice/timer

lib/timers.ts

@@ -0,0 +1,57 @@
+import * as fs from 'fs'
+import * as path from 'path'
+
+const DATA_DIR = fs.existsSync('/data') ? '/data' : '/tmp'
+const TIMERS_PATH = path.join(DATA_DIR, 'tablet-timers.json')
+
+export interface Timer {
+  id: string
+  label: string
+  startedAt: string // ISO
+  endsAt: string    // ISO
+  agent?: 'cosmo' | 'lusya'
+}
+
+function load(): Timer[] {
+  try {
+    if (fs.existsSync(TIMERS_PATH)) {
+      return JSON.parse(fs.readFileSync(TIMERS_PATH, 'utf-8'))
+    }
+  } catch {}
+  return []
+}
+
+function save(list: Timer[]) {
+  try {
+    fs.writeFileSync(TIMERS_PATH, JSON.stringify(list, null, 2))
+  } catch {}
+}
+
+// Mutative helpers, used by timer API route
+export function listActive(): Timer[] {
+  const now = Date.now()
+  // Drop any that expired over 30 min ago — stale garbage
+  const list = load().filter(t => new Date(t.endsAt).getTime() > now - 30 * 60 * 1000)
+  save(list)
+  return list
+}
+
+export function addTimer(t: Omit<Timer, 'id' | 'startedAt'>): Timer {
+  const full: Timer = {
+    id: Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
+    startedAt: new Date().toISOString(),
+    ...t,
+  }
+  const list = load()
+  list.push(full)
+  save(list)
+  return full
+}
+
+export function removeTimer(id: string): boolean {
+  const list = load()
+  const next = list.filter(t => t.id !== id)
+  if (next.length === list.length) return false
+  save(next)
+  return true
+}

lib/voice-tools.ts

@@ -0,0 +1,19 @@
+/**
+ * Helper для /api/voice/tools/* — общий bearer-check и forwarding к внутренним endpoint'ам.
+ * Позволяет голосовому скрипту вызывать tools через один и тот же токен (VOICE_API_KEY).
+ */
+
+export function isBearerAuthorized(req: Request): boolean {
+  const expected = process.env.VOICE_API_KEY
+  if (!expected) return false
+  const auth = req.headers.get('authorization') || ''
+  const token = auth.replace(/^Bearer\s+/i, '').trim()
+  return token === expected
+}
+
+export function unauthorized() {
+  return new Response(JSON.stringify({ error: 'unauthorized' }), {
+    status: 401,
+    headers: { 'Content-Type': 'application/json' },
+  })
+}