feat(dictate): support configurable ASR backends

systemd/user/pi-dictate.service

@@ -1,12 +1,19 @@
 # Managed by pi-dictate install.sh
 [Unit]
-Description=Pi local Parakeet dictation service
+Description=Pi dictation transcription service
 Requires=pi-dictate.socket
 After=pipewire.service
 
 [Service]
 Type=simple
+TimeoutStopSec=5s
 ExecStart=%h/.local/share/pi-dictate/venv/bin/pi-dictate-service
+Environment=PI_DICTATE_CONFIG_PATH=%h/.config/pi-dictate/config.json
+Environment=PI_DICTATE_DEPENDENCY_PROFILE_PATH=%h/.local/share/pi-dictate/.dependency-profile
+# local/offline is the fail-closed base. The installer-owned cloud drop-in
+# replaces these values only after a cloud configuration and dependency profile
+# have been installed.
+Environment=PI_DICTATE_NETWORK_MODE=offline
 Environment=PI_DICTATE_MODEL_PATH=%h/.local/share/pi-dictate/models/parakeet-tdt-0.6b-v3/parakeet-tdt-0.6b-v3.nemo
 Environment=PI_DICTATE_TERMS_PATH=%h/.local/share/pi-dictate/config/coding-terms.txt
 Environment=PI_DICTATE_BOOST_ALPHA=1.0
@@ -18,6 +25,13 @@ Environment=HF_HOME=/tmp/pi-dictate-huggingface
 Environment=TRITON_CACHE_DIR=/tmp/pi-dictate-triton
 Environment=NUMBA_CACHE_DIR=/tmp/pi-dictate-numba
 Environment=PYTHONDONTWRITEBYTECODE=1
+# Never inherit ambient proxy credentials or route audio through an unreviewed proxy.
+Environment=HTTP_PROXY=
+Environment=HTTPS_PROXY=
+Environment=ALL_PROXY=
+Environment=http_proxy=
+Environment=https_proxy=
+Environment=all_proxy=
 UMask=0077
 LimitCORE=0
 MemorySwapMax=0
@@ -29,9 +43,19 @@ ProtectKernelLogs=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 ProtectSystem=strict
-ProtectHome=read-only
+ProtectHome=tmpfs
+BindReadOnlyPaths=%h/.local/share/pi-dictate
+BindReadOnlyPaths=%h/.local/share/uv/python
+BindReadOnlyPaths=%h/.config/pi-dictate/config.json
+BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service
+BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service.d
+BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.socket
+BindReadOnlyPaths=%t/pipewire-0
 RestrictAddressFamilies=AF_UNIX
+SystemCallFilter=~bind listen
 IPAddressDeny=any
 LockPersonality=yes
+# Refuse a service/config/dependency/network-mode or hardening mismatch before runtime code starts.
+ExecStartPre=%h/.local/share/pi-dictate/venv/bin/python -c 'from pi_dictate_service.startup import validate_startup; validate_startup()'
 
 # The socket unit owns %t/pi-dictate.sock. The service must not unlink it.