feat: implement full UPDATE.md review — critical fixes, UI upgrade, infra hardening

Critical frontend bugs:
- Add TrackSubscribed/attach() for agent audio playback
- Fix decodeToString TypeError with TextDecoder
- XSS fix: innerHTML -> textContent in addMessage
- Fresh token on reconnect retry

Agent fixes:
- GemmaLLM subclass with reasoning_content fallback wrapper
- Disable Gemma 4 thinking mode via chat_template_kwargs (6.8s -> 0.5s)
- Remove duplicate session-level LLM
- Replace global _active_session with closure-based handler
- asyncio.create_task instead of deprecated get_event_loop
- Explicit silero VAD, topic filter on voice-control

Infra:
- supervisord: all programs log to /dev/stdout
- Dockerfile: uv sync --frozen with committed uv.lock
- nginx config moved to real file, token_server.py no longer served
- entrypoint.sh: cert persisted, only regenerated on IP change
- compose: healthcheck + cert volume
- token_server: CORS removed, room pinned to voice-room

UI upgrade:
- Orb UI with state machine (idle/connecting/listening/thinking/speaking)
- Streaming transcripts via lk.transcription text streams
- Barge-in hint, thinking chip, audio visualizer
- Glassmorphism, chat bubbles, settings sheet, light mode
- PWA manifest, favicon, wake-lock, safe-area insets
- localStorage conversation history

Docs: AGENTS.md drift fixed

supervisord.conf

@@ -1,5 +1,5 @@
 [supervisord]
-nodaemon=false
+nodaemon=true
 logfile=/var/log/supervisor/supervisord.log
 pidfile=/run/supervisord.pid
 
@@ -8,16 +8,18 @@ command=/usr/local/bin/livekit --config /etc/livekit.yaml
 user=root
 autostart=true
 autorestart=true
-stdout_logfile=/var/log/supervisor/livekit.log
-stderr_logfile=/var/log/supervisor/livekit_err.log
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+redirect_stderr=true
 
 [program:agent]
 command=/opt/voice-agent/.venv/bin/python /opt/voice-agent/agent.py start
 user=voiceuser
 autostart=true
 autorestart=true
-stdout_logfile=/var/log/supervisor/agent.log
-stderr_logfile=/var/log/supervisor/agent_err.log
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+redirect_stderr=true
 environment=
     LIVEKIT_URL="%(ENV_LIVEKIT_URL)s",
     LIVEKIT_API_KEY="%(ENV_LIVEKIT_API_KEY)s",
@@ -36,16 +38,18 @@ command=/usr/sbin/nginx -g "daemon off;"
 user=root
 autostart=true
 autorestart=true
-stdout_logfile=/var/log/supervisor/web.log
-stderr_logfile=/var/log/supervisor/web_err.log
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+redirect_stderr=true
 
 [program:token-server]
 command=/opt/voice-agent/.venv/bin/python /opt/voice/token_server.py
 user=voiceuser
 autostart=true
 autorestart=true
-stdout_logfile=/var/log/supervisor/token.log
-stderr_logfile=/var/log/supervisor/token_err.log
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+redirect_stderr=true
 environment=
     LIVEKIT_API_KEY="%(ENV_LIVEKIT_API_KEY)s",
     LIVEKIT_API_SECRET="%(ENV_LIVEKIT_API_SECRET)s"