Add microphone selection to Settings

[claude]

Requested by Mez · Slack thread

Before: Blurt always records from the system default input, via a per-session AVAudioRecorder writing a temp WAV. After: a Microphone dropdown in Settings › General — "Same as system (current default's name)" plus each input device — and capture runs on a single per-session AVCaptureSession recorder that binds to the pinned device (or the default), converts to the dictation API's 16 kHz mono S16LE in its data output, and accumulates the upload blob in memory. The choice persists as the device UID, and dictation falls back to the system default whenever the pinned device isn't connected (without unpinning).

What & why

Lets the user pin dictation to a specific microphone instead of always following the system default — e.g. keep AirPods for output while dictating into a USB mic.

How (single path, at Alex's direction): this PR originally shipped two backends — the untouched AVAudioRecorder WAV path for "same as system" plus a device-pinned AudioQueue. Per Alex Kroman's direction it now has one: CaptureSessionRecorder, an AVCaptureSession built fresh per capture behind MicCapture's CaptureRecorder seam (the fresh-recorder-per-session invariant is preserved; the AVAudioEngine/installTap ban is untouched and its check-invariants.sh anchors still pass --self-test; the settled-decisions prose in AGENTS.md / the guardrails skill / the script was updated consistently). Device selection is AVCaptureDevice(uniqueID:) — on macOS the uniqueID is the CoreAudio UID MicDeviceStore persists — with the pure, unit-tested missing-device fallback (MicDeviceSelection.effective) unchanged. The liveness gate's inputs are re-derived with MicLiveness itself unchanged: the clock is frames actually delivered (summed per sample buffer), power is the connection's AVCaptureAudioChannel.averagePowerLevel; fail-closed timeout, transport-keyed caps, and the Bluetooth tail linger still key off the resolved device's CoreAudio snapshot. Warm-up pre-builds the session without startRunning() — the device stays closed and no input indicator shows while idle — so route activation lands inside the press's connecting window (the liveness budget starts only after record() returns). A built-but-idle session holds nothing open, so the 60 s warm expiry (which existed to un-pin AirPods from their degraded output profile) is deleted.

Verify on real hardware (please read)

• MicLiveness.silenceFloorDB (-115 dBFS) — the load-bearing one. Kept at -115: the dBFS math is meter-independent (full scale = 0, one int16 LSB ≈ -90.3, digital silence at/near the meter floor, -115 in the empty band between). But it was calibrated on AVAudioRecorder's meter; where AVCaptureAudioChannel.averagePowerLevel actually bottoms out on zero-filled buffers — and what it reads before its first update — must be confirmed, or the gate could fail open. AirPods mid A2DP→HFP switch is the case that matters: the gate must keep holding on all-zero buffers until real samples flow. AudioInputDevicesTests (env-gated, BLURT_LIVE_AUDIO_TESTS=1) now asserts a live mic out-reads the floor.
• Warm/start latency: warm-up no longer pre-opens the route; startRunning() cost lands at every press, inside the connecting pill. Measure it wired and on AirPods against the old feel (the liveness frame-arrival caps — 300 ms local / 1 s unknown / 2.5 s BT — start after startRunning() returns, so they shouldn't need retuning, but the perceived press→chime time may grow).
• Tail linger on AirPods: confirm the 220 ms Bluetooth linger still recovers the last word with the session backend.
• Uniqueness assumption: AVCaptureDevice(uniqueID:) accepting the CoreAudio UID string for every device the picker lists (aggregates/virtual devices included).

Notes for review:

• App UI lives in the existing SoundStepView.swift (+ UITestIdentifiers, already in both targets), so project.yml/project.pbxproj are untouched — written on Linux where xcodegen can't run.
• Engine imports gained CoreMedia (block-buffer copy in the delegate; ships under AVFoundation's umbrella). The AudioQueue backend and its AudioToolbox import are gone. No SPM dependencies.
• The temp-WAV write/read-back and decodePCM are gone with the old backend — the release path hands the accumulated S16LE straight to upload.

How it was tested

On Linux — can't build/test Swift locally; CI on macOS is the authority. scripts/check.sh --portable passes (exit 0) including check-invariants.sh and its --self-test (the reworded settled-decision prose stays pinned in all three places). Suites: MicDeviceStoreTests (decode/round-trip/fallback), PersistedSettingsTests (roster 12 keys), MicCaptureFormatTests (meter math + error wording), the warm suite rewritten for the expiry-free lifecycle (identity probe, device/pin validation), live-gated AudioInputDevicesTests (enumeration, UID round-trip, session-recorder capture + silence-floor assertion — engine tests never touch real CoreAudio ungated), and the SettingsUITests picker case ("Same as system" default only).

• scripts/check.sh passes (or CI will, if I'm not on a Mac) — portable subset passes; full check runs on CI
• I read AGENTS.md and this doesn't reintroduce anything deliberately removed (the capture-backend prose was updated at the owner's direction; the bans stand)
• Docs updated if behavior changed (AGENTS.md table + MicCapture section + repo map, engine README, guardrails skill)