feat: air-gapped deployment guide, no implicit downloads

- Ship tiktoken's cl100k_base inside the package and build the encoding
  from it, so token counting never downloads anything.
- Default EMBEDDINGS_CACHE_DIR to <data home>/models instead of FastEmbed's
  temp dir, and read tokenizer.json and repo metadata from that cache, so
  a model downloads once and survives reboots.
- TTS_PROVIDER=none and STT_PROVIDER=none switch the speech features off:
  the endpoints return 404, audio files fail to ingest with a clear
  message, /api/config reports tts_available/stt_available, and the UI
  hides the Speak and microphone buttons.
- Drop the Google Fonts Roboto import from the web UI.
- prefetch-models fills the cache the app reads; verify-offline checks the
  packaged encoding.
- Docs: new Air-Gapped Deployment guide, settings and cache notes.

docsgpt/app.py

@@ -203,12 +203,16 @@ def health():
 @app.route("/api/config")
 def get_config():
     from docsgpt.graphrag import graphrag_available
+    from docsgpt.stt.stt_creator import STTCreator
+    from docsgpt.tts.tts_creator import TTSCreator
 
     response = {
         "auth_type": settings.AUTH_TYPE,
         "requires_auth": settings.AUTH_TYPE in ["simple_jwt", "session_jwt", "oidc"],
         "graphrag_available": graphrag_available(),
         "hybrid_available": settings.VECTOR_STORE == "pgvector",
+        "tts_available": TTSCreator.is_enabled(settings.TTS_PROVIDER),
+        "stt_available": STTCreator.is_enabled(settings.STT_PROVIDER),
     }
     if settings.AUTH_TYPE == "oidc":
         response["oidc"] = {