feat(transcription): allow an OpenAI-compatible endpoint for the openai provider

[HearthCore]

Summary

The openai transcription provider hardcodes https://api.openai.com/v1, whisper-1 and OPENAI_API_KEY. Chat routes already accept a custom OpenAI-compatible base URL, but voice clips cannot go through LiteLLM, Groq or a self-hosted gateway. And the local provider sends neither key nor model, so it only fits keyless Whisper services. Three optional env vars close that gap:

• TRANSCRIPTION_OPENAI_BASE_URL: base URL including /v1 (default https://api.openai.com/v1)
• TRANSCRIPTION_OPENAI_MODEL: default whisper-1
• TRANSCRIPTION_OPENAI_API_KEY: falls back to OPENAI_API_KEY

When unset, behaviour is unchanged. A keyless custom endpoint is called without an Authorization header, and api.openai.com still refuses to run without a key. TranscriptionResult.model now reports the model that was actually used. The self-hosting env table gains the transcription variables, which were missing entirely.

Type

• New feature

Test plan

• New apps/api/test/transcription-openai-compatible.test.ts (fetch mock, no DB): default path unchanged, custom URL/model/key, keyless endpoint, missing key on api.openai.com. 4/4 pass. On master, the two new-behaviour cases fail as expected.
• pnpm --filter @deft/api typecheck passes.
• git diff --check is clean.
• Real-world: a self-hosted 0.3.0-preview.15 source build has been transcribing voice clips through an OpenAI-compatible gateway (Groq whisper-large-v3-turbo behind it). Until now we got there via TRANSCRIPTION_PROVIDER=local + WHISPER_URL, which only works because that gateway needs no key and ignores model.
• Not run: the full pnpm --filter @deft/api test (needs a disposable Postgres) and pnpm build.

Checklist

• pnpm -r typecheck for @deft/api
• Relevant tests under apps/api/test/ pass
• No secrets, keys, or .env content committed

Related issues

None found (searched open and closed issues and PRs).

[HearthCore]

Ran the full Test API job locally the way ci.yml does it (pgvector/pgvector:pg16 container, push-full, db:seed:demo, seed-test-fixtures.ts, pnpm --filter @deft/api test with CI=true): 1459 tests, 1452 pass, 0 fail, 7 skipped.

Side note, unrelated to this PR: outside UTC, job-queue-reliability.test.ts › "exact dequeue filters claim one matching job…" fails on claimed.lockExpiresAt.getTime() > Date.now(). On a Europe/Berlin machine (UTC+2) the lease comes back in the past; with TZ=UTC all 9 tests in that file pass. So a lease timestamp is probably read as local time somewhere. GitHub runners use UTC, so CI never sees it.