feat(speech): add Deepgram as an alternate STT/TTS provider (Soniox remains default)

[pramodthe]

Summary

Adds Deepgram as an optional speech provider alongside the existing Soniox integration, behind a thin provider facade. Soniox remains the default and its behavior is unchanged.

• New facade (speech_cfg / speech_stt / speech_tts) so main, push‑to‑talk, and the AG‑UI client stay provider‑agnostic.
• Deepgram backends: Listen v1 (STT) and Speak v1 (TTS) over WebSocket — linear16 @ 16 kHz, reusing the same ES8311 mic/speaker path as Soniox.
• Runtime selection from the AMOLED‑setup captive portal: pick the provider, paste that vendor's API key, choose a voice.
• Backward compatible: existing devices (legacy soniox_key, or no speech_prov set) keep using Soniox with no reconfiguration.

Motivation

The device is a first‑class AG‑UI voice client; the STT/TTS vendor shouldn't be baked in. This makes the speech layer pluggable so users can choose a provider (and so a third can be added later) without touching the rest of the app.

What changed

Area	Change
speech_cfg	Resolve provider + API key from NVS; caches the provider (invalidated on portal save); migrates the legacy soniox_key.
speech_stt / speech_tts	Facades that dispatch to the active backend and tear down the previous backend's mic / drain task before opening the other provider.
deepgram_stt	Deepgram Listen v1 WSS backend (nova-3, interim results, endpointing/utterance‑end).
deepgram_tts	Deepgram Speak v1 WSS backend (Aura‑2 voices, streaming PCM → speaker, cancelable for barge‑in).
net_prov/portal	Provider dropdown + per‑provider voice lists; requires a key when switching provider; resets tts_voice to the new provider's default.
soniox_client / soniox_tts_client	Add *_deinit() for clean provider switching; read the key via speech_cfg. Otherwise unchanged.
main	Call the facades instead of Soniox directly.
docs	New docs/speech-providers.md (NVS keys, architecture, how to add a provider).

Design notes

• Single ES8311 owner. bsp_audio_codec_microphone_init() mints a new codec‑dev handle each call, so switching providers without a reboot could double‑own the mic. The STT facade tears down the previous backend (esp_codec_dev_close + esp_codec_dev_delete) before initializing the next, keeping a single owner of the shared I²S‑RX.
• Sequential TLS preserved. The Deepgram backends mirror the Soniox open → feed → finish → drain lifecycle; PSRAM buffers, and no new concurrent‑TLS path.
• Single‑writer transcript. The Deepgram STT commit path runs only on the WebSocket task (matching Soniox), avoiding cross‑task races on the transcript buffer.

Compatibility / migration

• Default provider is Soniox on fresh flash and on any device that has not set speech_prov.
• The legacy soniox_key is still read as a fallback when the provider is Soniox.
• Switching provider in the portal now requires entering a key for the new vendor.

NVS keys (appcfg)

Key	Meaning
speech_prov	deepgram | soniox (default soniox)
speech_key	API key for the active provider
soniox_key	Legacy Soniox‑only key (fallback when provider is Soniox)
tts_voice	Provider‑specific voice / model id

Testing

• ✅ idf.py build on ESP‑IDF 5.5.x / esp32s3 — builds clean, no new warnings (esp32_agui.bin, 31% app partition free).
• Manual (on Waveshare ESP32‑S3‑Touch‑AMOLED‑1.8):
  • Portal → provider = Deepgram + Deepgram key + Wi‑Fi + AG‑UI URL → PTT → transcript → spoken reply
  • Portal → switch to Soniox + Soniox key → same flow (no reboot)
  • Barge‑in (new PTT during TTS) cancels playback
  • Existing device with only legacy soniox_key still boots straight into Soniox

Notes for maintainers

See docs/speech-providers.md for the facade layout and how to add a third provider. Rule of thumb: never call a provider backend from main — always go through the facade.