feat(manager): add initial voiceover workflow slice

[lumberman]

Summary

Add the first manager-side voiceover slice for feat-014.

• adds an ElevenLabs-backed voiceover service with focused tests
• wires generateVoiceover through the create-job API and enrichment workflow
• persists and surfaces per-language translation and voiceover artifacts via authenticated manager download routes
• closes the review follow-ups by regenerating the CMS/GraphQL enum contract and keeping source-language voiceover jobs truthful after reload

Work Loop

• ce:plan done
• ce:work done
• ce:review done
• ce:compound done

Notes

• Plan: docs/plans/2026-04-22-feat-014-voiceover-tts-service-plan.md
• Review follow-up: apps/cms/schema.graphql and packages/graphql/src/graphql-env.d.ts now include the voiceover enum and are committed in this branch.
• Review follow-up: voiceover jobs now persist source language truth on create and reconcile to the detected transcription language inside the workflow.
• Browser validation used local smoke harnesses to confirm both per-language artifact links and the user-visible voiceover language badge state.
• Residual risk: older already-persisted jobs that saved target-only job.languages will not be backfilled by this PR.

Post-Deploy Monitoring & Validation

• Log queries/search terms: voiceover, ElevenLabs, voiceover_provider_error, voiceover_runtime_error, voiceover_config_error, workflow_error, jobId
• Metrics or dashboards to watch: manager job completion/failure counts for jobs with generateVoiceover, ElevenLabs error rate, artifact download 404s on /api/jobs/:id/artifacts/*
• Expected healthy signals: requested jobs show a completed voiceover step, voiceover-<lang>.mp3 artifacts appear, authenticated downloads return 200, and the jobs overview keeps the source-language badge after polling/reload
• Failure signals and rollback/mitigation trigger: repeated voiceover step failures, missing artifact links for completed jobs, source-language badge disappearing after reload, sustained artifact-route 404s, or elevated enrichment job failure rate after enabling voiceover
• Validation window and owner: first few voiceover-enabled jobs after merge, owned by automation follow-up / Vlad

[railway-app]

🚅 Deployed to the forge-pr-833 environment in forge

Service	Status	Web	Updated (UTC)
@forge/cms	✅ Success (View Logs)		May 20, 2026 at 2:22 am
@forge/manager	✅ Success (View Logs)		May 7, 2026 at 11:37 am
@forge/web	✅ Success (View Logs)		Apr 23, 2026 at 3:19 am