WIP: M3 PWA/offline implementation, M4 auth (backend + frontend), D-013 faster-whisper

- M3: hand-rolled service worker (precache + runtime /ort caching), precache
  manifest injection, SW registration/update toast, manifest + generated icons,
  production build script, offline indicator in ModelPicker (D-005/D-007)
- M4 backend: bun:sqlite users/sessions (D-009), Passport local strategy behind
  connect-compat adapter (D-008), /api/auth routes wired into dev+prod serving,
  Bun.password Argon2id, 38 auth tests
- M4 frontend: AuthForms + useAuth + framework-free authClient, session-aware
  header, anonymous-first fail-silent offline handling, 18 client tests
- D-013: server engine (M5) will use faster-whisper via Python sidecar;
  browser side stays Transformers.js (CTranslate2 has no WASM build)
- bun test: 83 pass / tsc --noEmit clean
- Note: M3 doc closeout (WorkBreakdown/Architecture/tests/offline.md) still in
  flight from a background agent; follow-up commit will finish docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/worker/protocol.ts

@@ -6,8 +6,29 @@
  * be unit-tested with `bun test`.
  */
 
-/** Devices supported by the worker. M1 is WASM-only; M2 adds "webgpu" (D-004). */
-export type InferenceDevice = "wasm";
+/** Devices the worker can actually run on (D-004). */
+export type InferenceDevice = "webgpu" | "wasm";
+
+/**
+ * What the UI may request. "auto" (the default) lets the worker probe
+ * `navigator.gpu` and pick WebGPU with automatic WASM fallback (D-004).
+ */
+export type DevicePreference = InferenceDevice | "auto";
+
+/** Quantization levels used by the curated catalog (D-006). */
+export type WhisperDtype = "fp32" | "fp16" | "q8" | "q4";
+
+/**
+ * Either one dtype for the whole model, or per-part dtypes — the shape
+ * Transformers.js accepts. Whisper on WebGPU commonly needs a mixed setup
+ * (e.g. fp16 encoder + q4 merged decoder), so per-part must be expressible.
+ */
+export type DtypeSpec =
+  | WhisperDtype
+  | { encoder_model: WhisperDtype; decoder_model_merged: WhisperDtype };
+
+/** Whisper generation task (multilingual models only). */
+export type WhisperTask = "transcribe" | "translate";
 
 // ---------------------------------------------------------------------------
 // UI → worker
@@ -17,7 +38,13 @@ export interface LoadMessage {
   type: "load";
   /** Hugging Face Hub model id, e.g. "onnx-community/whisper-tiny.en". */
   modelId: string;
-  device: InferenceDevice;
+  /** Device preference; the worker resolves "auto" and reports the outcome. */
+  device: DevicePreference;
+  /**
+   * Optional dtype override. When omitted the worker resolves the catalog
+   * default for the device it actually selected (src/lib/models.ts).
+   */
+  dtype?: DtypeSpec;
 }
 
 export interface TranscribeMessage {
@@ -27,6 +54,13 @@ export interface TranscribeMessage {
    * should be passed as a transferable for zero-copy handoff.
    */
   audio: Float32Array;
+  /**
+   * ISO-ish Whisper language code (e.g. "en", "da"). Omit (or "auto") to let
+   * Whisper detect the language. Only meaningful for multilingual models.
+   */
+  language?: string;
+  /** Only meaningful for multilingual models. Defaults to "transcribe". */
+  task?: WhisperTask;
 }
 
 export type UiToWorkerMessage = LoadMessage | TranscribeMessage;
@@ -38,7 +72,8 @@ export type UiToWorkerMessage = LoadMessage | TranscribeMessage;
 /**
  * Model download / initialization progress. Mirrors the Transformers.js
  * `progress_callback` events we care about; `status: "ready"` marks the end
- * of a successful load.
+ * of a successful load and reports the backend that actually got selected
+ * (after WebGPU detection / fallback, D-004).
  */
 export type LoadProgressMessage =
   | { type: "load-progress"; status: "initiate"; file: string }
@@ -55,7 +90,7 @@ export type LoadProgressMessage =
       progress: number;
     }
   | { type: "load-progress"; status: "done"; file: string }
-  | { type: "load-progress"; status: "ready" };
+  | { type: "load-progress"; status: "ready"; device: InferenceDevice };
 
 /** Incremental transcript fragment — append to the text streamed so far. */
 export interface PartialMessage {
@@ -96,13 +131,45 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null;
 }
 
+const DEVICES: readonly string[] = ["webgpu", "wasm"];
+const DTYPES: readonly string[] = ["fp32", "fp16", "q8", "q4"];
+
+export function isInferenceDevice(value: unknown): value is InferenceDevice {
+  return typeof value === "string" && DEVICES.includes(value);
+}
+
+export function isDevicePreference(value: unknown): value is DevicePreference {
+  return value === "auto" || isInferenceDevice(value);
+}
+
+export function isDtypeSpec(value: unknown): value is DtypeSpec {
+  if (typeof value === "string") return DTYPES.includes(value);
+  return (
+    isRecord(value) &&
+    typeof value.encoder_model === "string" &&
+    DTYPES.includes(value.encoder_model) &&
+    typeof value.decoder_model_merged === "string" &&
+    DTYPES.includes(value.decoder_model_merged)
+  );
+}
+
 export function isUiToWorkerMessage(value: unknown): value is UiToWorkerMessage {
   if (!isRecord(value)) return false;
   switch (value.type) {
     case "load":
-      return typeof value.modelId === "string" && value.device === "wasm";
+      return (
+        typeof value.modelId === "string" &&
+        isDevicePreference(value.device) &&
+        (value.dtype === undefined || isDtypeSpec(value.dtype))
+      );
     case "transcribe":
-      return value.audio instanceof Float32Array;
+      return (
+        value.audio instanceof Float32Array &&
+        (value.language === undefined || typeof value.language === "string") &&
+        (value.task === undefined ||
+          value.task === "transcribe" ||
+          value.task === "translate")
+      );
     default:
       return false;
   }
@@ -125,7 +192,7 @@ export function isWorkerToUiMessage(value: unknown): value is WorkerToUiMessage
             typeof value.progress === "number"
           );
         case "ready":
-          return true;
+          return isInferenceDevice(value.device);
         default:
           return false;
       }
@@ -159,9 +226,15 @@ export interface LoadProgressState {
   files: Record<string, FileProgress>;
   /** True once the pipeline reported ready. */
   ready: boolean;
+  /** Backend the worker actually selected; null until ready (D-004). */
+  device: InferenceDevice | null;
 }
 
-export const initialLoadProgress: LoadProgressState = { files: {}, ready: false };
+export const initialLoadProgress: LoadProgressState = {
+  files: {},
+  ready: false,
+  device: null,
+};
 
 /** Fold one load-progress message into the accumulated state. Pure. */
 export function applyLoadProgress(
@@ -169,7 +242,7 @@ export function applyLoadProgress(
   message: LoadProgressMessage,
 ): LoadProgressState {
   if (message.status === "ready") {
-    return { ...state, ready: true };
+    return { ...state, ready: true, device: message.device };
   }
   const previous = state.files[message.file];
   const next: FileProgress = {