Add cancel + progress UI, EngineToggle, and Docker deployment

Decisions.md

@@ -239,3 +239,30 @@ the universal fallback). The selected backend stays user-visible: the worker's
 `{status:"ready", device}` message drives a "Running on …" badge next to the
 Backend select (`ModelPicker`) and the engine line in the footer (D-004's
 "surfaced in the UI" requirement).
+
+## D-018 — Cancel a file transcription by terminating the worker
+**Status:** Accepted (2026-07-14)
+Users can cancel an in-flight file run (decode, model download kicked off by
+the drop, or the transcription pass itself) via a Cancel button next to the
+file name. Transformers.js exposes no abort API for a running `asr()` call,
+and on the WASM backend the pass blocks the worker's event loop — a "cancel"
+postMessage would sit unread until the pass finished anyway. So cancellation
+**terminates the inference worker** outright; it is the only reliable
+preemption and also aborts an in-flight weight download. A `fileRun` counter
+in `App.tsx` marks the decode that was running when the user cancelled as
+stale (`decodeAudioData` itself cannot be aborted), so it never posts audio to
+the fresh worker. The next run respawns the worker and reloads the pipeline —
+cheap, because the weights stay in the browser Cache API (D-005); the UI
+resets `loadStarted`/`loadProgress` so the reload starts from a clean slate.
+Live mode is untouched: it has its own stop/drain semantics (D-016), and a
+live session never coexists with a file run (mutually exclusive in the UI).
+**Alternatives rejected:** a cancel message handled between chunks (dead on
+WASM, where the event loop is blocked; and still seconds of latency
+elsewhere); `AbortSignal` plumbed into Transformers.js (no upstream support).
+**Consequence:** cancel throws away the loaded pipeline even when only the
+transcription was unwanted — an accepted cost since reloading from cache takes
+a few seconds.
+**Amendment (2026-07-14, EngineToggle landing):** a server-engine run cancels
+by aborting the `/api/transcribe` fetch instead (`AbortController`; the server
+cancels the sidecar pass between segments, D-011/D-013) — the inference worker
+and its loaded pipeline are left untouched in that path.