Widget Voice Token

Public: issue a short-lived LiveKit token for a widget voice session.

Billing accrues to the widget owner's wallet (same path as phone calls). Admission (mode/credit/daily-limit) is decided by _resolve_widget_voice.

Two guards run BEFORE admission, because admission burns the widget's daily visitor quota on the way through:

1. Origin allow-list. The chat endpoint has always enforced this; voice did not, so a widget could be embedded on any site and spend the owner's balance per minute. An Origin header is forgeable by a script, but it does stop the realistic case — someone dropping the public widget id into their own page.
2. Per-IP daily cap. The per-widget cap alone lets one visitor exhaust the day's quota and lock out real ones; this bounds a single source.