Serve call audio through c2-core instead of GCS signed URLs

upload_audio() could only sign a URL when GCP_CREDENTIALS_PATH pointed at a
service-account key file. The deployed VM runs on Application Default
Credentials with no key file, so every upload silently took the fallback
branch and returned a bare gs:// URI. That broke two things at once:

  * Browsers cannot fetch a gs:// URI, so no recording was ever playable.
  * _public_url_to_gcs_uri() only matched https://storage.googleapis.com/ and
    returned None for it, so `if gcs_uri:` in the upload path was always false
    and transcription never ran. Nothing was logged, which is why this looked
    like an OpenAI credits problem rather than a storage one.

The fallback also interpolated the client-supplied filename instead of the
call_id-derived safe name, so the URI did not even name the object written.

Calls now store only the canonical gs:// location. A short-lived playback link
is minted per read as an HMAC over (call_id, expiry) keyed by SERVICE_KEY, and
audio is served from the private bucket by the new /media route. An <audio src>
cannot carry an Authorization header, so the link has to be the credential;
that router is therefore public with the check done inline, as enrollment.py
already does. Signing GCS URLs from the VM would have needed a
serviceAccountTokenCreator grant on its own service account — this avoids the
IAM change entirely and keeps the bucket private.

gcs_uri_for_call() reconstructs the object name from call_id, so recordings
made before this fix are reachable again without a data migration.

Frontend rows come straight from Firestore via onSnapshot and never see a
server-minted field, so CallRow fetches the link lazily on expand.

Also removes the last long-lived (1 year) signed URL and the log line that
printed it.

drb-c2-core/app/routers/upload.py

@@ -47,16 +47,15 @@ async def upload_call_audio(
     if len(data) > settings.upload_max_bytes:
         raise HTTPException(413, f"File too large (max {settings.upload_max_bytes // (1024*1024)} MB).")
 
-    audio_url = await upload_audio(data, file.filename or "", call_id=call_id)
+    gcs_uri = await upload_audio(data, file.filename or "", call_id=call_id)
 
-    if audio_url:
+    if gcs_uri:
         try:
-            await fstore.doc_set("calls", call_id, {"audio_url": audio_url})
+            # Canonical object location only. The playback link is minted per
+            # read in storage.playback_url() — nothing durable is stored here.
+            await fstore.doc_set("calls", call_id, {"audio_gcs_uri": gcs_uri})
         except Exception as e:
-            logger.warning(f"Could not update call {call_id} with audio_url: {e}")
-
-        # Convert public GCS URL to gs:// URI for Speech-to-Text
-        gcs_uri = _public_url_to_gcs_uri(audio_url)
+            logger.warning(f"Could not update call {call_id} with audio_gcs_uri: {e}")
 
         background_tasks.add_task(
             _run_intelligence_pipeline,
@@ -68,21 +67,7 @@ async def upload_call_audio(
             gcs_uri=gcs_uri,
         )
 
-    return {"url": audio_url}
-
-
-def _public_url_to_gcs_uri(url: str) -> Optional[str]:
-    """
-    Convert a public GCS URL (possibly signed) like
-      https://storage.googleapis.com/bucket/calls/file.mp3?Expires=...
-    to a gs:// URI usable by Speech-to-Text.
-    Returns None if the URL doesn't look like a GCS URL.
-    """
-    prefix = "https://storage.googleapis.com/"
-    if url and url.startswith(prefix):
-        path = url[len(prefix):].split("?")[0]  # strip signed-URL query params
-        return "gs://" + path
-    return None
+    return {"url": gcs_uri}
 
 
 async def _correlate_with_consensus(