Stage a recording and, unless transcribe is false, return its transcript.

The access gate is resolve_source_type_and_gate - the same one /observations/quick-note applies on send. Running it before Deepgram means the transcribe call rejects in exactly the cases the send would, so a clinician can never dictate for five minutes into a note they are not allowed to file (and we never pay Deepgram for one).

It runs before read_bounded too, but that ordering saves a copy and not a transfer: FastAPI resolves audio_file by awaiting request.form(), which drains the whole multipart body before this function's first line, so an ungranted clinician has already pushed their recording by the time the 403 is decided. Refusing the upload before the bytes leave the phone would take a separate pre-flight, which nothing here has.