feat: air-gapped deployment guide, no implicit downloads

- Ship tiktoken's cl100k_base inside the package and build the encoding
  from it, so token counting never downloads anything.
- Default EMBEDDINGS_CACHE_DIR to <data home>/models instead of FastEmbed's
  temp dir, and read tokenizer.json and repo metadata from that cache, so
  a model downloads once and survives reboots.
- TTS_PROVIDER=none and STT_PROVIDER=none switch the speech features off:
  the endpoints return 404, audio files fail to ingest with a clear
  message, /api/config reports tts_available/stt_available, and the UI
  hides the Speak and microphone buttons.
- Drop the Google Fonts Roboto import from the web UI.
- prefetch-models fills the cache the app reads; verify-offline checks the
  packaged encoding.
- Docs: new Air-Gapped Deployment guide, settings and cache notes.

tests/scripts/test_prefetch_models.py

@@ -95,17 +95,12 @@ class TestMain:
             prefetch_models.main(["granite-97m"])
         assert spy.call_args.args[1] == "/app/models"
 
+    def test_cache_dir_defaults_to_the_one_the_app_reads(self, fake_fastembed, monkeypatch):
+        """Without the variable, models must land where the running app looks for them."""
+        from docsgpt.core.settings import settings
 
-class TestPrefetchTiktoken:
-    def test_warms_every_listed_encoding(self):
-        """The image sets TIKTOKEN_CACHE_DIR; warming fills it at build time."""
-        fake = MagicMock()
-        module = types.ModuleType("tiktoken")
-        module.get_encoding = fake
-        with patch.dict(sys.modules, {"tiktoken": module}):
-            fetched = prefetch_models.prefetch_tiktoken()
-        assert fetched == list(prefetch_models.TIKTOKEN_ENCODINGS)
-        assert [c.args[0] for c in fake.call_args_list] == list(prefetch_models.TIKTOKEN_ENCODINGS)
-
-    def test_cl100k_is_the_encoding_token_counting_uses(self):
-        assert "cl100k_base" in prefetch_models.TIKTOKEN_ENCODINGS
+        monkeypatch.delenv("EMBEDDINGS_CACHE_DIR", raising=False)
+        monkeypatch.setattr(settings, "EMBEDDINGS_CACHE_DIR", "/home/docsgpt/models")
+        with patch.object(prefetch_models, "prefetch", return_value=[]) as spy:
+            prefetch_models.main(["granite-97m"])
+        assert spy.call_args.args[1] == "/home/docsgpt/models"

tests/scripts/test_verify_offline.py

@@ -8,8 +8,11 @@ from docsgpt.scripts import verify_offline
 
 
 def _fake_tiktoken(monkeypatch):
+    """The check must exercise the app's own loader, which reads the packaged encoding."""
+    encoding = types.SimpleNamespace(name="cl100k_base", encode=lambda text: [1, 2])
+    monkeypatch.setattr("docsgpt.utils.get_encoding", lambda: encoding)
     module = types.ModuleType("tiktoken")
-    module.get_encoding = lambda name: types.SimpleNamespace(encode=lambda text: [1, 2])
+    module.get_encoding = lambda name: (_ for _ in ()).throw(AssertionError("downloaded via tiktoken"))
     monkeypatch.setitem(sys.modules, "tiktoken", module)