feat: air-gapped deployment guide, no implicit downloads

- Ship tiktoken's cl100k_base inside the package and build the encoding
  from it, so token counting never downloads anything.
- Default EMBEDDINGS_CACHE_DIR to <data home>/models instead of FastEmbed's
  temp dir, and read tokenizer.json and repo metadata from that cache, so
  a model downloads once and survives reboots.
- TTS_PROVIDER=none and STT_PROVIDER=none switch the speech features off:
  the endpoints return 404, audio files fail to ingest with a clear
  message, /api/config reports tts_available/stt_available, and the UI
  hides the Speak and microphone buttons.
- Drop the Google Fonts Roboto import from the web UI.
- prefetch-models fills the cache the app reads; verify-offline checks the
  packaged encoding.
- Docs: new Air-Gapped Deployment guide, settings and cache notes.

tests/parser/file/test_audio_parser.py

@@ -1,6 +1,9 @@
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 from docsgpt.parser.file.audio_parser import AudioParser
+from docsgpt.parser.file.base_parser import DocumentParseError
 from docsgpt.parser.file.bulk import get_default_file_extractor
 from docsgpt.stt.upload_limits import AudioFileTooLargeError
 
@@ -44,6 +47,20 @@ def test_audio_parser_transcribes_file(
     )
 
 
+@patch("docsgpt.parser.file.audio_parser.STTCreator.create_stt")
+@patch("docsgpt.parser.file.audio_parser.settings")
+def test_audio_parser_refuses_when_speech_to_text_is_disabled(
+    mock_settings, mock_create_stt, tmp_path
+):
+    mock_settings.STT_PROVIDER = "none"
+    audio_file = tmp_path / "meeting.wav"
+    audio_file.write_bytes(b"audio-bytes")
+
+    with pytest.raises(DocumentParseError, match="STT_PROVIDER"):
+        AudioParser().parse_file(audio_file)
+    mock_create_stt.assert_not_called()
+
+
 @patch("docsgpt.stt.upload_limits.settings")
 def test_audio_parser_rejects_oversized_files(mock_limit_settings, tmp_path):
     mock_limit_settings.STT_MAX_FILE_SIZE_MB = 1