feat(voice): add a mic button to the desktop and vs code composers

[Zfinix]

Stacked on #47. Part of #46.

What changes

• New aster dictate command. It records until stdin gets a line or closes, then prints NDJSON: listening, transcribing, then transcript (text) or error (message, detail). The TUI and this command share the plain-language error copy (crates/aster-cli/src/dictate.rs).
• Desktop: a mic button in the chat composer. Tauri commands start_dictation, stop_dictation and cancel_dictation run aster dictate and forward its lines as aster://dictation. The bundle gains the com.apple.security.device.audio-input entitlement and an NSMicrophoneUsageDescription, without which the hardened runtime kills the process when it opens the mic.
• VS Code: a mic button in the webview composer (editor only, not the aster serve browser page). The host runs aster dictate per webview, and a new dictation message pair is added to protocol.ts.
• Both buttons work the same way: press to listen, press again to transcribe, Esc discards. Transcripts are inserted at the caret, and errors show one plain sentence.

Why a separate command

The desktop app starts a new aster chat --stream process per turn, and VS Code talks ACP. Neither has a channel open before the user sends a message, which is exactly when dictation happens. A standalone command leaves the stream and ACP contracts alone and adds a new surface rather than changing an existing one.

Found along the way, not fixed here

desktop/src-tauri/src/lib.rs: the chat command takes the child's stdin into a local and never stores it, so answer_approval can never find it and later approvals read as "no".

Testing

• make check and make desktop-check pass. The VS Code host and webview typecheck, and vitest passes, including new src/dictation.test.ts covering chunked lines, a CLI that exits without a result, and cancel.
• aster dictate ran on macOS with the real microphone. It reported a missing key as expected, and with a key present it refused a 0.1 second clip before uploading anything.
• Not tried: a full transcription with a real key, and the buttons inside the built desktop app and VS Code.

🤖 Generated with Claude Code

[Zfinix]

Folded into #47, which now carries all of the voice work in one PR.