feat: air-gapped deployment guide, no implicit downloads

- Ship tiktoken's cl100k_base inside the package and build the encoding
  from it, so token counting never downloads anything.
- Default EMBEDDINGS_CACHE_DIR to <data home>/models instead of FastEmbed's
  temp dir, and read tokenizer.json and repo metadata from that cache, so
  a model downloads once and survives reboots.
- TTS_PROVIDER=none and STT_PROVIDER=none switch the speech features off:
  the endpoints return 404, audio files fail to ingest with a clear
  message, /api/config reports tts_available/stt_available, and the UI
  hides the Speak and microphone buttons.
- Drop the Google Fonts Roboto import from the web UI.
- prefetch-models fills the cache the app reads; verify-offline checks the
  packaged encoding.
- Docs: new Air-Gapped Deployment guide, settings and cache notes.

tests/test_app_routes.py

@@ -95,6 +95,28 @@ class TestConfigRoute:
         data = json.loads(response.data)
         assert data["hybrid_available"] is False
 
+    @pytest.mark.unit
+    def test_speech_features_available_by_default(self, client):
+        with patch("docsgpt.app.settings") as mock_settings:
+            mock_settings.AUTH_TYPE = None
+            mock_settings.TTS_PROVIDER = "google_tts"
+            mock_settings.STT_PROVIDER = "openai"
+            response = client.get("/api/config")
+        data = json.loads(response.data)
+        assert data["tts_available"] is True
+        assert data["stt_available"] is True
+
+    @pytest.mark.unit
+    def test_speech_features_unavailable_when_disabled(self, client):
+        with patch("docsgpt.app.settings") as mock_settings:
+            mock_settings.AUTH_TYPE = None
+            mock_settings.TTS_PROVIDER = "none"
+            mock_settings.STT_PROVIDER = "none"
+            response = client.get("/api/config")
+        data = json.loads(response.data)
+        assert data["tts_available"] is False
+        assert data["stt_available"] is False
+
     @pytest.mark.unit
     def test_oidc_config_exposes_login_paths(self, client):
         with patch("docsgpt.app.settings") as mock_settings: