Serve call audio through c2-core instead of GCS signed URLs

upload_audio() could only sign a URL when GCP_CREDENTIALS_PATH pointed at a
service-account key file. The deployed VM runs on Application Default
Credentials with no key file, so every upload silently took the fallback
branch and returned a bare gs:// URI. That broke two things at once:

  * Browsers cannot fetch a gs:// URI, so no recording was ever playable.
  * _public_url_to_gcs_uri() only matched https://storage.googleapis.com/ and
    returned None for it, so `if gcs_uri:` in the upload path was always false
    and transcription never ran. Nothing was logged, which is why this looked
    like an OpenAI credits problem rather than a storage one.

The fallback also interpolated the client-supplied filename instead of the
call_id-derived safe name, so the URI did not even name the object written.

Calls now store only the canonical gs:// location. A short-lived playback link
is minted per read as an HMAC over (call_id, expiry) keyed by SERVICE_KEY, and
audio is served from the private bucket by the new /media route. An <audio src>
cannot carry an Authorization header, so the link has to be the credential;
that router is therefore public with the check done inline, as enrollment.py
already does. Signing GCS URLs from the VM would have needed a
serviceAccountTokenCreator grant on its own service account — this avoids the
IAM change entirely and keeps the bucket private.

gcs_uri_for_call() reconstructs the object name from call_id, so recordings
made before this fix are reachable again without a data migration.

Frontend rows come straight from Firestore via onSnapshot and never see a
server-minted field, so CallRow fetches the link lazily on expand.

Also removes the last long-lived (1 year) signed URL and the log line that
printed it.

drb-c2-core/app/config.py

@@ -68,6 +68,16 @@ class Settings(BaseSettings):
     # Upload size limit — reject audio files larger than this (bytes). Default 100 MB.
     upload_max_bytes: int = 100 * 1024 * 1024
 
+    # Public origin this API is reachable on, e.g. "https://api.drb.example.com".
+    # Only used to build absolute call-audio playback links: an <audio src> is
+    # fetched by the browser directly, so a relative path would resolve against
+    # the frontend origin, not this one.
+    public_api_url: Optional[str] = None
+
+    # How long a minted call-audio playback link stays valid. Long enough for a
+    # browsing session, short enough that a copied link isn't durable access.
+    audio_link_ttl_seconds: int = 6 * 60 * 60
+
     # CORS — set to your frontend origin(s) in production, e.g. ["https://app.example.com"]
     # Defaults to "*" for local development only.
     cors_origins: list[str] = ["*"]