feat(ptt): code-side initial split — transmit_active / capability badge / sanitizer

Implements the gen2 v0.9.3 doc baseline's first slice of code work:

  * SRS-201: split the audio engine's `ptt` AtomicBool into the
    authoritative `transmit_active` flag. The legacy `set_ptt` /
    `ptt` accessors are retained as `#[doc(hidden)]` thin wrappers
    so the existing bridge command and the existing Flutter
    hold-to-talk UI keep compiling.
  * SAD-075 / SDD-089 acknowledged at the type level: only
    `AudioEngine::set_transmit_active` (or its legacy alias)
    mutates the flag; the encoder feed reads it once per outbound
    frame and never writes.
  * SDD-082: new `chanora_audio::ptt` module ships the
    `PttCapabilityLevel` enum (`L0Focused`, `L1GlobalShortcut`,
    `L2GlobalHoldToTalk`, `L3GlobalWithMouseButtons`,
    `L4DeviceAware` reserved) with a stable `as_str` mapping and
    an `is_global` classifier.
  * SDD-087: `PttBackendDescriptor::focused()` constant value for
    the universal Focused-PTT fallback. The struct shape carries
    only privacy-safe fields (`level`, `backend_id`,
    `bound_input_class`) — a key code cannot fit through this
    surface by construction (DEC-027).
  * SAD-077 / SDD-090: `RedactingLogLayer` now hosts the
    `PttBanCheckVisitor` and the `PTT_BANNED_FIELDS` constant
    (`key_code`, `scan_code`, `virtual_key`, `vk`, `keysym`,
    `keysym_string`, `key_sequence`, `key_press_history`,
    `key_timing`). Any record whose field set names a banned key
    is dropped before reaching the in-memory log sink or the
    user-initiated diagnostic export. The check is structural and
    runs ahead of formatting / redaction.
  * `SessionEvent::PttCapability` carries the diagnostics-safe
    descriptor through the broadcast event stream;
    `chanora_core::ChanoraSession::start_audio` publishes the
    Focused-PTT descriptor when the audio engine starts (SRS-196
    / SDD-091).
  * `BridgeEvent::PttCapability` mirrors the event across the
    FFI boundary. flutter_rust_bridge codegen regenerated.
  * Flutter `_AudioControls` renders a capability badge above the
    PTT button: a globe icon for Global levels, a focus-frame
    icon for `L0Focused`, plus a Tooltip exposing the bound input
    class. New ARB key `pttCapabilityBadge(level, backend)` in
    `app_en.arb` and `app_zh.arb`.

Per-platform global PTT backends (`WindowsRawInputBackend`,
`MacOSEventTapBackend`, `LinuxGnomeWaylandBackend`) and the
`MissedKeyUpWatchdog` task land in a separate follow-up commit;
this milestone ships only PTT-L0 universally so the application's
runtime capability reporting is honest from day one.

Tests
-----

* `chanora_audio` rises from 1 to 4 unit tests covering
  `PttCapabilityLevel::as_str`, `is_global`, and the
  `PttBackendDescriptor::focused()` shape contract.
* `chanora_diagnostics` rises from 9 to 11 unit tests covering
  the new `PttBanCheckVisitor` over every banned field name and
  the `PTT_BANNED_FIELDS` stability assertion.
* Workspace total: 53 unit + integration tests, all green with
  `CHANORA_DISABLE_KEYRING=1` (was 49 at v1.0.0-rc.2).
* `flutter analyze`: clean.
* `cargo deny check`: advisories ok, bans ok, licenses ok,
  sources ok.
* `cargo about generate`: zero warnings (license inventory
  regenerated).
* `tools/dump_flutter_licenses.sh`: 94 packages, zero without
  LICENSE.
* Linux x86_64 release bundle builds clean.

No Android live verification in this commit per the user's note
that the test device was removed. Android arm64-v8a continues to
build via the same `cargo ndk` path; runtime reporting on Android
is `L0Focused` for the foreseeable future.

core/chanora_core/src/lib.rs

@@ -45,7 +45,9 @@ use tokio::sync::{broadcast, oneshot, watch, Mutex};
 use tokio::task::JoinHandle;
 use tracing::{info, warn};
 
-pub use chanora_audio::{AudioEngine, AudioEngineConfig};
+pub use chanora_audio::{
+    AudioEngine, AudioEngineConfig, PttBackendDescriptor, PttCapabilityLevel,
+};
 pub use chanora_diagnostics::{
     DiagnosticExport, InMemoryLogSink, KnownSecretRegistry, RedactingLogLayer, Redactor,
 };
@@ -133,6 +135,21 @@ pub enum SessionEvent {
         /// Number of clients in the latest probe snapshot.
         clients: u32,
     },
+    /// Detected desktop Push-to-Talk capability (gen2 v0.9.3 /
+    /// DEC-023..028). Published when the audio engine starts or
+    /// when the active backend transitions (for example macOS
+    /// permission state change). Carries only the privacy-safe
+    /// descriptor — capability level, backend identifier, bound
+    /// input class — per SRS-202 / DEC-027.
+    PttCapability {
+        /// Stable level name from `PttCapabilityLevel::as_str()`.
+        level: String,
+        /// Stable backend identifier (e.g. `"focused"`).
+        backend_id: String,
+        /// Coarse bound input class (e.g. `"keyboard"`); empty when
+        /// no binding is active.
+        bound_input_class: String,
+    },
 }
 
 /// Coarse OS-reported network state. Populated by the Flutter side
@@ -437,6 +454,18 @@ impl ChanoraSession {
             sup.audio_running = true;
         }
         let _ = self.events_tx.send(SessionEvent::AudioStarted);
+        // Publish the current PTT capability so the UI badge can
+        // render an honest value (SRS-196 / SDD-091). The current
+        // milestone ships only the universal Focused backend
+        // (PTT-L0); per-platform global backends arrive in a
+        // follow-up code commit. The descriptor is privacy-safe
+        // by construction (DEC-027).
+        let desc = PttBackendDescriptor::focused();
+        let _ = self.events_tx.send(SessionEvent::PttCapability {
+            level: desc.level.as_str().to_string(),
+            backend_id: desc.backend_id.to_string(),
+            bound_input_class: desc.bound_input_class.unwrap_or("").to_string(),
+        });
         Ok(())
     }