feat(audio,bridge,flutter): v1 audio + PTT lifecycle implementation (SDD-094..097)

Implement the SDD-094 / SDD-095 / SDD-096 / SDD-097 detailed designs
committed in dfa84ee.

Rust side
- chanora_audio::TransmitMode enum (Ptt/Continuous/VoiceActivity) with
  serde-friendly u8 repr (SDD-095).
- chanora_audio::TransmitModeSelector: lock-free Atomic-backed selector
  that is the sole writer of transmit_active (per SAD-083), applying
  hard_mute as a final clamp. VoiceActivity falls through to Continuous
  for v1 (DEC-030 placeholder).
- chanora_audio::ReleaseTailTimer: tokio-task-owning struct driving the
  selector's ptt_held input; default 200 ms tail, configurable 0–500 ms
  with AtomicU32 hot read; pending JoinHandle held in a std::sync::Mutex
  touched only on PTT edge transitions (SDD-096).
- chanora_storage: AudioMeta persisted as audio_meta.json next to
  identity.dek; get/set_transmit_mode + get/set_release_tail_ms with
  0..=500 clamp on write.
- chanora_core::ChanoraSession: voice_join(channel, password) and
  voice_leave() are the new lifecycle entry points; ensure_audio_running
  and shutdown_audio_if_idle are private helpers around the existing
  Option<AudioEngine> field. SessionEvent::VoiceState carries the
  in_channel / transmit_mode / mute / release_tail_ms tuple. Selector
  state survives reconnect; supervisor rewires it to each fresh engine
  gate.
- chanora_bridge: drop start_audio; add voice_join, voice_leave,
  set/get_transmit_mode, set/get_release_tail_ms, set_hard_mute.
  BridgeEvent::VoiceState mirrors the core event. AudioStarted/Stopped
  kept for backwards compat but Flutter ignores them in the new UI.

Flutter side
- New apps/chanora_flutter/lib/widgets/voice_bar.dart replaces the
  legacy _AudioControls widget. Renders channel pill, mode badge,
  mute toggle, level meter, PttCapabilityBadge, leave button. No
  manual Start affordance anywhere.
- New apps/chanora_flutter/lib/widgets/voice_settings.dart dialog with
  TransmitMode radio group (VoiceActivity disabled with 'Coming soon'
  trailing label per DEC-030), bind-key button, release-tail slider
  0–500 ms step 25.
- main.dart: state fields _inChannel, _transmitMode, _hardMute,
  _releaseTailMs driven by BridgeEvent_VoiceState. Channel-tap now
  calls voiceJoin instead of moveToChannel. Removed _onStartAudio,
  _audioStarted-gated branch, and the FilledButton.
- l10n: 11 new strings in app_en.arb + app_zh.arb.

Verification
- cargo check --workspace: clean.
- cargo test --workspace --lib: 72 passed / 0 failed / 1 ignored
  (chanora_audio: +12 new tests for TransmitMode/Selector/ReleaseTail;
  chanora_storage: +2 new tests for audio_meta round-trip).
- flutter analyze: 0 errors, 0 warnings; 6 infos are the Flutter 3.32
  Radio.groupValue deprecation (pre-existing API usage).
- FRB Dart/Rust bindings regenerated via flutter_rust_bridge_codegen.

Follow-up (intentionally deferred)
- PttController and per-platform PTT backends still drive AudioTransmitGate
  directly via the legacy set_ptt path; routing those key edges through
  ChanoraSession::release_tail_timer().{key_down,key_up} so the tail
  applies to native PTT input is a contained wiring change in a follow-up.
- Real audio-level RMS in BridgeAudioStats (current meter is binary).
- VoiceActivity backend (DEC-030).

crates/chanora_storage/src/lib.rs

@@ -49,6 +49,7 @@ use chacha20poly1305::aead::{Aead, KeyInit, OsRng};
 use chacha20poly1305::{ChaCha20Poly1305, Key, Nonce};
 use rand::RngCore;
 use rusqlite::{params, Connection};
+use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use tracing::{info, warn};
 use zeroize::Zeroize;
@@ -88,6 +89,34 @@ pub trait LocalDatabaseRepository: Send + Sync {}
 /// promoted from the secure-storage PoC.
 pub trait SecretStorageRepository: Send + Sync {}
 
+/// Audio-related per-identity settings persisted alongside the
+/// identity file as a small JSON blob (SDD-095 / SDD-096). These
+/// are *not* secrets; they sit beside the encrypted identity in
+/// app-private storage.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct AudioMeta {
+    /// Encoded [`chanora_audio::TransmitMode`]. Default is
+    /// `TransmitMode::Ptt as u8 == 0`.
+    #[serde(default)]
+    transmit_mode: u8,
+    /// Release-tail in milliseconds (SDD-096). Default 200.
+    #[serde(default = "default_release_tail_ms")]
+    release_tail_ms: u32,
+}
+
+fn default_release_tail_ms() -> u32 {
+    200
+}
+
+impl Default for AudioMeta {
+    fn default() -> Self {
+        Self {
+            transmit_mode: 0,
+            release_tail_ms: 200,
+        }
+    }
+}
+
 /// Beta identity store: a single ChaCha20-Poly1305-encrypted file
 /// containing the base64 TS3 identity string. The Data Encryption
 /// Key (DEK) is 32 random bytes stored in the platform keyring
@@ -410,6 +439,72 @@ impl IdentityFileStore {
         Ok(())
     }
 
+    /// Path to the small JSON metadata file that sits alongside
+    /// the identity. Holds audio settings (`transmit_mode`,
+    /// `release_tail_ms`) per SDD-095/096. Stored in plaintext —
+    /// these values are not secrets.
+    fn meta_path(&self) -> PathBuf {
+        let dir = self
+            .path
+            .parent()
+            .map(Path::to_path_buf)
+            .unwrap_or_else(|| PathBuf::from("."));
+        dir.join("audio_meta.json")
+    }
+
+    fn read_meta(&self) -> AudioMeta {
+        match fs::read_to_string(self.meta_path()) {
+            Ok(s) => serde_json::from_str(&s).unwrap_or_default(),
+            Err(_) => AudioMeta::default(),
+        }
+    }
+
+    fn write_meta(&self, m: &AudioMeta) -> Result<(), StorageError> {
+        let path = self.meta_path();
+        let tmp = path.with_extension("json.tmp");
+        let body = serde_json::to_vec_pretty(m)
+            .map_err(|e| StorageError::Io(format!("meta serialize: {e}")))?;
+        {
+            let mut f = fs::File::create(&tmp)
+                .map_err(|e| StorageError::Io(format!("open meta {tmp:?}: {e}")))?;
+            f.write_all(&body)
+                .map_err(|e| StorageError::Io(format!("write meta: {e}")))?;
+            f.sync_all()
+                .map_err(|e| StorageError::Io(format!("sync meta: {e}")))?;
+        }
+        fs::rename(&tmp, &path)
+            .map_err(|e| StorageError::Io(format!("rename meta {tmp:?} -> {path:?}: {e}")))?;
+        Ok(())
+    }
+
+    /// Persist the user's chosen transmit mode (SDD-095). The
+    /// encoding matches `chanora_audio::TransmitMode::as_u8()`.
+    pub fn set_transmit_mode(&self, mode: u8) -> Result<(), StorageError> {
+        let mut m = self.read_meta();
+        m.transmit_mode = mode;
+        self.write_meta(&m)
+    }
+
+    /// Read the persisted transmit mode. Defaults to `0`
+    /// (`TransmitMode::Ptt`) when no value has been written.
+    pub fn get_transmit_mode(&self) -> u8 {
+        self.read_meta().transmit_mode
+    }
+
+    /// Persist the user's chosen release-tail (SDD-096). Clamped
+    /// to `0..=500` ms inclusive on write.
+    pub fn set_release_tail_ms(&self, ms: u32) -> Result<(), StorageError> {
+        let mut m = self.read_meta();
+        m.release_tail_ms = ms.min(500);
+        self.write_meta(&m)
+    }
+
+    /// Read the persisted release-tail in milliseconds. Defaults
+    /// to `200` (SDD-096 default) when no value has been written.
+    pub fn get_release_tail_ms(&self) -> u32 {
+        self.read_meta().release_tail_ms
+    }
+
     /// Remove any persisted identity. No-op if none exists. Leaves
     /// the DEK in place so future saves don't generate a new one.
     pub fn clear(&self) -> Result<(), StorageError> {
@@ -1034,6 +1129,37 @@ mod tests {
         assert!(row.1.is_some(), "blob should be set after upgrade");
     }
 
+    #[test]
+    fn audio_meta_defaults_and_persists() {
+        force_keyring_off();
+        let tmp = tempdir();
+        let store = IdentityFileStore::new(&tmp).unwrap();
+        // Defaults before any write.
+        assert_eq!(store.get_transmit_mode(), 0);
+        assert_eq!(store.get_release_tail_ms(), 200);
+        // Persist values.
+        store.set_transmit_mode(1).unwrap();
+        store.set_release_tail_ms(75).unwrap();
+        assert_eq!(store.get_transmit_mode(), 1);
+        assert_eq!(store.get_release_tail_ms(), 75);
+        // Reopen the store — values survive.
+        drop(store);
+        let store2 = IdentityFileStore::new(&tmp).unwrap();
+        assert_eq!(store2.get_transmit_mode(), 1);
+        assert_eq!(store2.get_release_tail_ms(), 75);
+    }
+
+    #[test]
+    fn release_tail_ms_clamped_on_write() {
+        force_keyring_off();
+        let tmp = tempdir();
+        let store = IdentityFileStore::new(&tmp).unwrap();
+        store.set_release_tail_ms(9999).unwrap();
+        assert_eq!(store.get_release_tail_ms(), 500);
+        store.set_release_tail_ms(0).unwrap();
+        assert_eq!(store.get_release_tail_ms(), 0);
+    }
+
     fn tempdir() -> PathBuf {
         let p = std::env::temp_dir()
             .join("chanora_storage_test")