feat: implement full UPDATE.md review — critical fixes, UI upgrade, infra hardening

Critical frontend bugs:
- Add TrackSubscribed/attach() for agent audio playback
- Fix decodeToString TypeError with TextDecoder
- XSS fix: innerHTML -> textContent in addMessage
- Fresh token on reconnect retry

Agent fixes:
- GemmaLLM subclass with reasoning_content fallback wrapper
- Disable Gemma 4 thinking mode via chat_template_kwargs (6.8s -> 0.5s)
- Remove duplicate session-level LLM
- Replace global _active_session with closure-based handler
- asyncio.create_task instead of deprecated get_event_loop
- Explicit silero VAD, topic filter on voice-control

Infra:
- supervisord: all programs log to /dev/stdout
- Dockerfile: uv sync --frozen with committed uv.lock
- nginx config moved to real file, token_server.py no longer served
- entrypoint.sh: cert persisted, only regenerated on IP change
- compose: healthcheck + cert volume
- token_server: CORS removed, room pinned to voice-room

UI upgrade:
- Orb UI with state machine (idle/connecting/listening/thinking/speaking)
- Streaming transcripts via lk.transcription text streams
- Barge-in hint, thinking chip, audio visualizer
- Glassmorphism, chat bubbles, settings sheet, light mode
- PWA manifest, favicon, wake-lock, safe-area insets
- localStorage conversation history

Docs: AGENTS.md drift fixed

Dockerfile

@@ -14,13 +14,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 COPY agent/pyproject.toml ./agent/
-RUN cd /app/agent && \
-    uv venv .venv && \
-    uv pip install --python .venv/bin/python \
-        "livekit-agents[mcp]~=1.7" \
-        "livekit-plugins-azure~=1.7" \
-        "livekit-plugins-openai~=1.7" \
-        "python-dotenv"
+COPY agent/uv.lock ./agent/
+RUN cd /app/agent && uv sync --frozen
 
 # ── Stage 2: Runtime (use same base for Python compat) ─────────────────────
 FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim AS runtime
@@ -48,7 +43,12 @@ COPY agent/agent.py /opt/voice-agent/agent.py
 COPY agent/web_mcp.py /opt/voice-agent/web_mcp.py
 
 # Copy web frontend + token endpoint
-COPY web/ /var/www/voice/
+COPY web/index.html /var/www/voice/
+COPY web/app.js /var/www/voice/
+COPY web/style.css /var/www/voice/
+COPY web/livekit-client.umd.js /var/www/voice/
+COPY web/manifest.json /var/www/voice/
+COPY web/favicon.svg /var/www/voice/
 COPY web/token_server.py /opt/voice/token_server.py
 
 # Config files
@@ -59,11 +59,10 @@ COPY supervisord.conf /etc/supervisor/conf.d/voice.conf
 # Browsers require a secure context (HTTPS or localhost) for microphone access.
 # The self-signed cert (with the LAN IP in the SAN) is generated at container
 # start by entrypoint.sh.
+COPY nginx.conf /etc/nginx/sites-available/voice
 RUN rm -f /etc/nginx/sites-enabled/default \
-    && mkdir -p /etc/voice/certs \
-    && printf 'server {\n    listen 8090 ssl;\n    root /var/www/voice;\n    index index.html;\n    ssl_certificate /etc/voice/certs/cert.pem;\n    ssl_certificate_key /etc/voice/certs/key.pem;\n    location /token {\n        proxy_pass http://127.0.0.1:8091/token;\n        proxy_set_header Content-Type application/json;\n    }\n    location = /livekit {\n        return 301 /livekit/;\n    }\n    location /livekit/ {\n        proxy_pass http://127.0.0.1:7880/;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection "upgrade";\n        proxy_set_header Host $host;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n    }\n    location / {\n        try_files $uri $uri/ =404;\n    }\n}\n' \
-    > /etc/nginx/sites-available/voice \
-    && ln -sf /etc/nginx/sites-available/voice /etc/nginx/sites-enabled/voice
+    && ln -sf /etc/nginx/sites-available/voice /etc/nginx/sites-enabled/voice \
+    && mkdir -p /etc/voice/certs
 
 # Create non-root user for agent
 RUN useradd -m -s /bin/bash voiceuser || true