Don't show the live "recording"/listening indicator until the model is ready

startLive()'s browser-engine branch flipped liveStatus to "listening" (the
red live-dot, "Listening..." hint) the instant the mic was granted, even if
the Whisper pipeline was still loading — the user saw an active-looking
session while nothing was being transcribed yet. transcribeLiveSegment()
already correctly awaits the model-ready gate before posting a segment, so
this was purely a misleading-status bug.

Adds a "loading-model" LiveStatus between "starting" and "listening";
startLive() now waits on the same browserModelReady() gate the transcribe
path uses before claiming "listening", with race-safe cleanup if the load
fails while waiting. Server-engine live is unaffected.

Adds Decisions.md D-034; updates tests/live.md's manual verification steps.

tests/live.md

@@ -43,10 +43,13 @@ Re-run it after any change to `src/lib/live.ts`, `src/lib/mic.ts`,
 2. The browser prompts for the microphone. **Deny** it: the button must return
    to idle and the error "Microphone access was denied…" must appear; the app
    stays usable (file flow unaffected).
-3. Click again and **allow**: button becomes **Stop** with a pulsing red dot;
-   the browser's mic indicator turns on. If the model wasn't downloaded yet,
-   the download progress panel appears and live text simply starts once it is
-   ready (segment passes queue in the worker).
+3. Click again and **allow**: the browser's mic indicator turns on immediately.
+   If the model was already loaded, the button becomes **Stop** with a pulsing
+   red dot right away. If not (first use, or a model/device switch), the
+   button instead shows **"Loading model…"** (disabled, no live dot, no
+   "Listening…" hint) while the download/progress panel appears, and only
+   flips to **Stop**/pulsing dot once the pipeline actually reports ready
+   (D-034) — it must never claim "Listening" before that.
 
 ## 2. Live transcription behavior