Fono

Hotfix: cloud STT post-validation gate did not actually run because the
default json response format does not include the detected language.
v0.3.1's confidence-aware rerun was correct but unreachable.

Fixed

• Cloud STT post-validation gate now actually fires. The first-pass
  Groq / OpenAI request was using response_format=json (the implicit
  default), which does not include the detected language field —
  only verbose_json does. The post-validation block at
  groq.rs:271/openai.rs:217/groq_streaming.rs:399 therefore
  silently skipped on every call, even when Groq returned Bulgarian
  for English audio with languages = ["ro", "en"]. Both batch and
  streaming first-pass requests now send response_format=verbose_json
  (zero latency cost — same endpoint, different output shape).
• Detected language is now normalised from Whisper's full English name
  ("english", "bulgarian") to alpha-2 ("en", "bg") before the
  allow-list check, via a new crate::lang::whisper_lang_to_code
  helper covering all 99 Whisper-supported languages. Without
  normalisation, "bulgarian" != "bg" would have prevented the gate
  from firing even with verbose_json.