feat: air-gapped deployment guide, no implicit downloads

- Ship tiktoken's cl100k_base inside the package and build the encoding
  from it, so token counting never downloads anything.
- Default EMBEDDINGS_CACHE_DIR to <data home>/models instead of FastEmbed's
  temp dir, and read tokenizer.json and repo metadata from that cache, so
  a model downloads once and survives reboots.
- TTS_PROVIDER=none and STT_PROVIDER=none switch the speech features off:
  the endpoints return 404, audio files fail to ingest with a clear
  message, /api/config reports tts_available/stt_available, and the UI
  hides the Speak and microphone buttons.
- Drop the Google Fonts Roboto import from the web UI.
- prefetch-models fills the cache the app reads; verify-offline checks the
  packaged encoding.
- Docs: new Air-Gapped Deployment guide, settings and cache notes.

tests/core/test_paths.py

@@ -57,12 +57,23 @@ class TestSettingsFollowTheHome:
         assert fresh.MILVUS_URI == str(tmp_path.resolve() / "milvus_local.db")
         assert fresh.LANCEDB_PATH == str(tmp_path.resolve() / "data" / "lancedb")
 
+    def test_model_cache_defaults_under_the_home(self, monkeypatch, tmp_path):
+        """FastEmbed's own default is the temp dir, which a reboot wipes."""
+        from docsgpt.core.settings import Settings
+
+        monkeypatch.setenv(paths.HOME_ENV, str(tmp_path))
+        monkeypatch.delenv("EMBEDDINGS_CACHE_DIR", raising=False)
+        assert Settings(_env_file=None).EMBEDDINGS_CACHE_DIR == str(tmp_path.resolve() / "models")
+
     def test_env_overrides_still_win(self, monkeypatch, tmp_path):
         from docsgpt.core.settings import Settings
 
         monkeypatch.setenv(paths.HOME_ENV, str(tmp_path))
         monkeypatch.setenv("LANCEDB_PATH", "/srv/lancedb")
-        assert Settings(_env_file=None).LANCEDB_PATH == "/srv/lancedb"
+        monkeypatch.setenv("EMBEDDINGS_CACHE_DIR", "/srv/models")
+        fresh = Settings(_env_file=None)
+        assert fresh.LANCEDB_PATH == "/srv/lancedb"
+        assert fresh.EMBEDDINGS_CACHE_DIR == "/srv/models"
 
 
 class TestPackageDir: