feat(web): add push-to-talk, VAD continuous listening, and voice settings

.do/deploy.template.yaml

@@ -10,7 +10,7 @@ spec:
         registry_type: GHCR
         registry: ghcr.io
         repository: moltis-org/moltis
-        tag: "0.10.6"
+        tag: "0.10.11"
       instance_count: 1
       instance_size_slug: basic-xxs
       http_port: 8080

.github/workflows/ci.yml

@@ -165,8 +165,7 @@ jobs:
           fi
       - name: Build Tailwind CSS
         run: |
-          curl -sLO https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64
-          chmod +x tailwindcss-linux-x64
+          ./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
           cd crates/web/ui && TAILWINDCSS=../../../tailwindcss-linux-x64 ./build.sh
       - run: cargo clippy -Z unstable-options --workspace --all-features --all-targets --timings -- -D warnings
       - name: Upload cargo timing reports
@@ -232,8 +231,7 @@ jobs:
           tool: cargo-llvm-cov
       - name: Build Tailwind CSS
         run: |
-          curl -sLO https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64
-          chmod +x tailwindcss-linux-x64
+          ./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
           cd crates/web/ui && TAILWINDCSS=../../../tailwindcss-linux-x64 ./build.sh
       - name: Generate coverage
         run: cargo llvm-cov --workspace --exclude moltis-tools --exclude moltis-swift-bridge --lcov --output-path lcov.info
@@ -271,8 +269,7 @@ jobs:
 
       - name: Build Tailwind CSS
         run: |
-          curl -sLO https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64
-          chmod +x tailwindcss-linux-x64
+          ./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
           cd crates/web/ui && TAILWINDCSS=../../../tailwindcss-linux-x64 ./build.sh
 
       - name: Build moltis binary
@@ -327,8 +324,7 @@ jobs:
 
       - name: Build Tailwind CSS
         run: |
-          curl -sLO https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-macos-arm64
-          chmod +x tailwindcss-macos-arm64
+          ./scripts/download-tailwindcss-cli.sh tailwindcss-macos-arm64
           cd crates/web/ui && TAILWINDCSS=../../../tailwindcss-macos-arm64 ./build.sh
 
       - name: Build Swift bridge and generate Xcode project
@@ -432,8 +428,7 @@ jobs:
           fi
       - name: Build Tailwind CSS
         run: |
-          curl -sLO https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64
-          chmod +x tailwindcss-linux-x64
+          ./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
           cd crates/web/ui && TAILWINDCSS=../../../tailwindcss-linux-x64 ./build.sh
       - run: cargo clippy -Z unstable-options --workspace --all-features --all-targets --timings -- -D warnings
       - name: Upload cargo timing reports

.github/workflows/local-ci.yml

@@ -0,0 +1,178 @@
+name: Local CI (PR)
+
+# This workflow runs on pull_request events and sets commit statuses that
+# the upstream local-validation jobs poll for. Each job sets the corresponding
+# local/<check>=success status after running the actual check.
+
+on:
+  pull_request:
+
+permissions: {}
+
+env:
+  NIGHTLY_TOOLCHAIN: nightly-2025-11-30
+
+jobs:
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1
+        with:
+          advanced-security: false
+          online-audits: false
+      - name: Report zizmor status
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          JOB_STATUS: ${{ job.status }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          STATE=$([[ "$JOB_STATUS" == "success" ]] && echo "success" || echo "failure")
+          gh api repos/$REPO/statuses/$SHA -f state=$STATE -f context=local/zizmor -f description="Zizmor security scan"
+
+  biome-i18n:
+    name: Biome + i18n
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: biomejs/setup-biome@29711cbb52afee00eb13aeb30636592f9edc0088 # v2
+        with:
+          version: "2.3.13"
+      - run: biome ci crates/web/src/assets/js/
+      - run: ./scripts/i18n-check.sh
+      - name: Report statuses
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          JOB_STATUS: ${{ job.status }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          STATE=$([[ "$JOB_STATUS" == "success" ]] && echo "success" || echo "failure")
+          gh api repos/$REPO/statuses/$SHA -f state=$STATE -f context=local/biome -f description="Biome lint"
+          gh api repos/$REPO/statuses/$SHA -f state=$STATE -f context=local/i18n -f description="i18n check"
+
+  fmt:
+    name: Format
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
+        with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
+          components: rustfmt
+      - run: cargo fmt --all -- --check
+      - name: Report fmt status
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          JOB_STATUS: ${{ job.status }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          STATE=$([[ "$JOB_STATUS" == "success" ]] && echo "success" || echo "failure")
+          gh api repos/$REPO/statuses/$SHA -f state=$STATE -f context=local/fmt -f description="Rust format check"
+
+  rust-ci:
+    name: Clippy + Test
+    needs: [fmt, biome-i18n]
+    runs-on: [self-hosted, Linux, X64]
+    permissions:
+      contents: read
+      statuses: write
+    container:
+      image: nvidia/cuda:12.4.1-devel-ubuntu22.04
+    env:
+      LD_LIBRARY_PATH: /usr/local/cuda/compat:/usr/local/nvidia/lib:/usr/local/nvidia/lib64
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Clean up corrupted cargo config
+        run: rm -f ~/.cargo/config.toml
+      - name: Install build dependencies
+        run: |
+          apt-get update
+          apt-get install -y curl git cmake build-essential clang libclang-dev pkg-config ca-certificates nodejs npm
+      - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
+        with:
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
+          components: clippy
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          shared-key: local-ci-v1
+          cache-all-crates: true
+      - name: Build Tailwind CSS
+        run: |
+          ./scripts/download-tailwindcss-cli.sh tailwindcss-linux-x64
+          cd crates/web/ui && npm ci --ignore-scripts && TAILWINDCSS=../../../tailwindcss-linux-x64 ./build.sh
+      - name: Initialize git repo in llama-cpp source
+        run: |
+          cargo fetch --locked
+          LLAMA_SRC=$(find ~/.cargo/registry/src -name "llama-cpp-sys-2-*" -type d 2>/dev/null | head -1)
+          if [ -n "$LLAMA_SRC" ] && [ ! -d "$LLAMA_SRC/.git" ]; then
+            cd "$LLAMA_SRC"
+            git init && git config user.email "ci@example.com" && git config user.name "CI"
+            git add -A && git commit -m "init" --allow-empty && git tag v0.0.0
+          fi
+      - id: clippy
+        run: cargo clippy -Z unstable-options --workspace --all-features --all-targets -- -D warnings
+        continue-on-error: true
+      - uses: taiki-e/install-action@f176c07a0a40cbfdd08ee9aa8bf1655701d11e69 # v2
+        with:
+          tool: cargo-nextest
+      - id: nextest
+        run: cargo nextest run --all-features --profile ci
+        continue-on-error: true
+      - name: Report statuses
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CLIPPY_OUTCOME: ${{ steps.clippy.outcome }}
+          NEXTEST_OUTCOME: ${{ steps.nextest.outcome }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          if [ "$CLIPPY_OUTCOME" = "success" ]; then CLIPPY_STATE=success; else CLIPPY_STATE=failure; fi
+          if [ "$NEXTEST_OUTCOME" = "success" ]; then TEST_STATE=success; else TEST_STATE=failure; fi
+          curl -s -X POST "https://api.github.com/repos/$REPO/statuses/$SHA" \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            -d "{\"state\":\"$CLIPPY_STATE\",\"context\":\"local/lint\",\"description\":\"Clippy lint\"}"
+          curl -s -X POST "https://api.github.com/repos/$REPO/statuses/$SHA" \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            -d "{\"state\":\"$TEST_STATE\",\"context\":\"local/test\",\"description\":\"cargo nextest\"}"
+
+  skip-macos-ios:
+    name: Skip macOS/iOS
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Set macos-app and ios-app to success (no runner)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          gh api repos/$REPO/statuses/$SHA -f state=success -f context=local/macos-app -f description="No macOS runner skipped"
+          gh api repos/$REPO/statuses/$SHA -f state=success -f context=local/ios-app -f description="No iOS runner skipped"