feat: enable FlashAttention-2 for all models via runtime install + SDPA fallback

perf: preload all models at startup, improve Q&A context and auto-submit

fix: replace Supertonic with Qwen3-TTS 0.6B CustomVoice, fix Play button

fix: XSS sanitization, per-request audio files, soundfile-based ASR

feat: wire Whisper-small ASR and Qwen2.5-3B Q&A into app (sprint steps 9-10)