feat(config): support voice API key

[owainlewis]

Summary

• add [voice].openai_api_key as a config-based credential
• keep OPENAI_API_KEY as the higher-priority environment override
• make doctor and fallback messages report both setup paths without exposing secrets
• require mode 0600 on Unix when the OpenAI key is stored in config
• update voice, service, launchd, configuration, architecture, and security docs

Why

Launchd does not inherit shell environment variables, so storing the voice key in the existing private Push config makes local setup much simpler.

Test plan

• cargo fmt --all --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked (256 tests passed across all suites)
• bash tests/install.sh
• mkdocs build --strict in an isolated virtual environment
• git diff --check
• independent review, including a second pass after addressing findings

Risks

Existing environment-only setups remain compatible. On Unix, a config containing voice.openai_api_key must be owner-only; doctor and startup preflight provide an actionable chmod 600 error otherwise.

Related issue

None.