[bug] stt: whisper-server HTTP path still uses unbounded read_line and fail-opens errors into transcripts

[kurosawareiji7007-hub]

Summary

SttEngine::transcribe_via_server still hand-rolls an HTTP response reader with unbounded read_line, no connect/request deadline, no status check, and JSON parse fail-open — the same class of bug fixed for LLM/HA outbound clients in #655/#656, but missed for the whisper-server STT path.

Evidence (crates/genie-core/src/voice/stt.rs)

• TcpStream::connect with no timeout
• Header/body loop via BufReader::read_line with no byte cap (endless line → OOM)
• HTTP status never inspected
• serde_json::from_str(...).unwrap_or_else(|_| json!({text: response_body})) turns 5xx HTML / garbage into a spoken transcript

Impact

A hung or malicious/broken whisper-server can wedge the voice loop, OOM the process, or cause error pages to be spoken as user speech.

Proposed fix

Mirror HA/LLM outbound clients:

1. Connect + full request under timeouts
2. Read via genie_common::http::read_response + HttpResponseLimits
3. Require 2xx
4. Strict JSON parse (fail closed)

Acceptance

• Oversized header/body rejected
• Non-2xx and malformed JSON error out (no fake transcript)
• Valid {text:...} still works
• Focused regression tests
• No prompt / Jetson-4096 impact

Scope

Systems correctness (bounded I/O + fail-closed). Distinct from #808 (subprocess timeouts) and #790 (whisper-cli).

[kurosawareiji7007-hub]

Working on this. Fix ready on fix/stt-whisper-server-bounded-http (bounded read_response, connect/request timeouts, 2xx + strict JSON). Will open the PR as soon as one of my current open PRs (#907 / #909) merges — repo enforces max 2 open PRs per author.